4290
4305
"build highly scalable, cloud computing for both public and private clouds."
4293
#: serverguide/C/virtualization.xml:1374(title) serverguide/C/network-auth.xml:2702(title) serverguide/C/monitoring.xml:13(title) serverguide/C/lamp-applications.xml:15(title) serverguide/C/installation.xml:911(title) serverguide/C/dns.xml:62(title) serverguide/C/dm-multipath.xml:135(title) serverguide/C/chat.xml:15(title) serverguide/C/backups.xml:545(title)
4308
#: serverguide/C/virtualization.xml:1374(title)
4309
msgid "Installation and Configuration"
4297
4312
#: serverguide/C/virtualization.xml:1376(para)
4299
"This tutorial covers the OpenStack installation from the Ubuntu 12.10 Server "
4300
"Edition CD, and assumes a basic network topology, with a single system "
4301
"serving as the \"all-in-one cloud infrastructure\".Due to the tutorial's "
4302
"simplicity, the instructions as-is are not intended to set up production "
4303
"servers although it allows you to have a POC (proof of concept) of the "
4304
"Ubuntu Cloud using OpenStack."
4314
"Due to the current high rate of development of this complex technology we "
4315
"refer the reader to <ulink url=\"http://docs.openstack.org/havana/install-"
4316
"guide/install/apt/content/\"> upstream documentation</ulink> for all matters "
4317
"concerning installation and configuration."
4307
4320
#: serverguide/C/virtualization.xml:1385(title)
4308
msgid "Prerequisites"
4321
msgid "Support and Troubleshooting"
4311
4324
#: serverguide/C/virtualization.xml:1387(para)
4313
"To deploy a minimal Ubuntu Cloud infrastructure, you'll need at least:"
4316
#: serverguide/C/virtualization.xml:1392(para)
4317
msgid "One dedicated system."
4320
#: serverguide/C/virtualization.xml:1396(para)
4321
msgid "Two network address ranges (private network and public network)."
4324
#: serverguide/C/virtualization.xml:1401(para)
4326
"Make sure the host in question supports VT ( Virtualization Technology ) "
4327
"since we will be using KVM as the virtualization technology. Other "
4328
"hypervisors are also supported such as QEMU, UML, Vmware ESX/ESXi and XEN. "
4329
"LXC (Linux Containers) is also supported through libvirt."
4332
#: serverguide/C/virtualization.xml:1407(para)
4334
"Check if your system supports kvm issuing <application><command>sudo kvm-"
4335
"ok</command></application> in a linux terminal."
4338
#: serverguide/C/virtualization.xml:1413(para)
4340
"The <command>\"Minimum Topology\"</command> recommended for production use "
4341
"is using three nodes - One master server running nova services (except "
4342
"compute) and two servers running nova-compute. This setup is not redundant "
4343
"and the master server is a SPoF (Single Point of Failure)."
4346
#: serverguide/C/virtualization.xml:1421(title)
4347
msgid "Preconfiguring the network"
4350
#: serverguide/C/virtualization.xml:1423(para)
4352
"Before we start installing OpenStack we need to make sure we have bridging "
4353
"support installed, a MySQL database, and a central time server (ntp). This "
4354
"will assure that we have instantiated machines and hosts in sync."
4357
#: serverguide/C/virtualization.xml:1428(para)
4359
"In this example the \"private network\" will be in the 10.0.0.0/24 range on "
4360
"eth1. All the internal communication between instances will happen there "
4361
"while the \"public network\" will be in the 10.153.107.0/29 range on eth0."
4364
#: serverguide/C/virtualization.xml:1434(title)
4365
msgid "Install bridging support"
4368
#: serverguide/C/virtualization.xml:1442(title)
4369
msgid "Install and configure NTP"
4372
#: serverguide/C/virtualization.xml:1445(command) serverguide/C/network-config.xml:1093(command)
4373
msgid "sudo apt-get install ntp"
4376
#: serverguide/C/virtualization.xml:1448(para)
4378
"Add these two lines at the end of the <filename>/etc/ntp.conf</filename> "
4382
#: serverguide/C/virtualization.xml:1451(programlisting)
4386
"server 127.127.1.0\n"
4387
"fudge 127.127.1.0 stratum 10\n"
4390
#: serverguide/C/virtualization.xml:1456(para)
4391
msgid "Restart ntp service"
4394
#: serverguide/C/virtualization.xml:1459(command)
4395
msgid "sudo service ntp restart"
4398
#: serverguide/C/virtualization.xml:1464(title)
4399
msgid "Install and configure MySQL"
4402
#: serverguide/C/virtualization.xml:1467(command) serverguide/C/databases.xml:42(command)
4403
msgid "sudo apt-get install mysql-server"
4406
#: serverguide/C/virtualization.xml:1470(para)
4407
msgid "Create a database and mysql user for OpenStack"
4410
#: serverguide/C/virtualization.xml:1473(command)
4411
msgid "sudo mysql -uroot -ppassword -e \"CREATE DATABASE nova;\""
4414
#: serverguide/C/virtualization.xml:1474(command)
4416
"sudo mysql -uroot -ppassword -e \"GRANT ALL ON nova.* TO novauser@localhost "
4420
#: serverguide/C/virtualization.xml:1475(command)
4421
msgid "IDENTIFIED BY 'novapassword';\""
4424
#: serverguide/C/virtualization.xml:1478(para)
4426
"The line continuation character <application>\"\\\"</application> implies "
4427
"that you must include the subsequent line as part of the current command."
4430
#: serverguide/C/virtualization.xml:1485(title)
4431
msgid "Install OpenStack Compute (Nova)"
4434
#: serverguide/C/virtualization.xml:1487(para)
4436
"<command>OpenStack Compute (Nova)</command> is a cloud computing fabric "
4437
"controller (the main part of an IaaS system). It is written in Python, using "
4438
"the Eventlet and Twisted frameworks, and relies on the standard AMQP "
4439
"messaging protocol, and SQLAlchemy for data store access."
4442
#: serverguide/C/virtualization.xml:1493(para)
4443
msgid "Install OpenStack Nova components"
4446
#: serverguide/C/virtualization.xml:1496(command)
4448
"sudo apt-get install nova-api nova-network nova-volume nova-objectstore nova-"
4452
#: serverguide/C/virtualization.xml:1497(command)
4453
msgid "nova-compute euca2ools unzip"
4456
#: serverguide/C/virtualization.xml:1500(para)
4457
msgid "Restart libvirt-bin just to make sure libvirtd is aware of ebtables."
4460
#: serverguide/C/virtualization.xml:1504(command)
4461
msgid "sudo service libvirt-bin restart"
4464
#: serverguide/C/virtualization.xml:1507(para)
4465
msgid "Install RabbitMQ - Advanced Message Queuing Protocol (AMQP)"
4468
#: serverguide/C/virtualization.xml:1510(command)
4469
msgid "sudo apt-get install rabbitmq-server"
4472
#: serverguide/C/virtualization.xml:1513(para)
4473
msgid "Edit <filename>/etc/nova/nova.conf</filename> and add the following:"
4476
#: serverguide/C/virtualization.xml:1516(programlisting)
4480
"# Nova config FlatDHCPManager\n"
4481
"--sql_connection=mysql://novauser:novapassword@localhost/nova\n"
4482
"--flat_injected=true\n"
4483
"--network_manager=nova.network.manager.FlatDHCPManager\n"
4484
"--fixed_range=10.0.0.0/24\n"
4485
"--floating_range=10.153.107.72/29\n"
4486
"--flat_network_dhcp_start=10.0.0.2\n"
4487
"--flat_network_bridge=br100\n"
4488
"--flat_interface=eth1\n"
4489
"--public_interface=eth0\n"
4492
#: serverguide/C/virtualization.xml:1529(para)
4493
msgid "Restart OpenStack services"
4496
#: serverguide/C/virtualization.xml:1532(command) serverguide/C/virtualization.xml:1537(command)
4498
"for i in nova-api nova-network nova-objectstore nova-scheduler nova-volume "
4502
#: serverguide/C/virtualization.xml:1533(command)
4503
msgid "do sudo stop $i; sleep 2; done"
4506
#: serverguide/C/virtualization.xml:1538(command)
4507
msgid "do sudo start $i; sleep 2; done"
4510
#: serverguide/C/virtualization.xml:1541(para)
4512
"Migrate Nova database from sqlite db to MySQL db. It may take a while."
4515
#: serverguide/C/virtualization.xml:1545(command)
4516
msgid "sudo nova-manage db sync"
4519
#: serverguide/C/virtualization.xml:1548(para)
4521
"Define a specific <application>private network</application> where all your "
4522
"Instances will run. This will be used in the network of fixed Ips set inside "
4523
"<filename>nova.conf </filename>."
4526
#: serverguide/C/virtualization.xml:1553(command)
4528
"sudo nova-manage network create --fixed_range_v4 10.0.0.0/24 --label private "
4532
#: serverguide/C/virtualization.xml:1554(command)
4533
msgid "--bridge_interface br100"
4536
#: serverguide/C/virtualization.xml:1557(para)
4538
"Define a specific public network and allocate 6 (usable) Floating Public IP "
4539
"addresses for use with the instances starting from 10.153.107.72."
4542
#: serverguide/C/virtualization.xml:1562(command)
4543
msgid "sudo nova-manage floating create --ip_range=10.153.107.72/29"
4546
#: serverguide/C/virtualization.xml:1565(para)
4548
"Create a user (user1), a project (project1), download credentials and source "
4549
"its configuration file."
4552
#: serverguide/C/virtualization.xml:1569(command)
4553
msgid "cd ; mkdir nova ; cd nova"
4556
#: serverguide/C/virtualization.xml:1570(command)
4557
msgid "sudo nova-manage user admin user1"
4560
#: serverguide/C/virtualization.xml:1571(command)
4561
msgid "sudo nova-manage project create project1 user1"
4564
#: serverguide/C/virtualization.xml:1572(command)
4565
msgid "sudo nova-manage project zipfile project1 user1"
4568
#: serverguide/C/virtualization.xml:1573(command)
4569
msgid "unzip nova.zip"
4572
#: serverguide/C/virtualization.xml:1574(command) serverguide/C/virtualization.xml:1657(command)
4573
msgid "source novarc"
4576
#: serverguide/C/virtualization.xml:1577(para)
4577
msgid "Verify the OpenStack Compute installation by typing:"
4580
#: serverguide/C/virtualization.xml:1580(command)
4581
msgid "sudo nova-manage service list"
4584
#: serverguide/C/virtualization.xml:1581(command)
4585
msgid "sudo nova-manage version list"
4588
#: serverguide/C/virtualization.xml:1584(para)
4590
"If nova services don't show up correctly restart OpenStack services as "
4591
"described previously. For more information please refer to the "
4592
"troubleshooting section on this guide."
4595
#: serverguide/C/virtualization.xml:1590(title)
4596
msgid "Install Imaging Service (Glance)"
4599
#: serverguide/C/virtualization.xml:1592(para)
4601
"Nova uses Glance service to manage Operating System images that it needs for "
4602
"bringing up instances. Glance can use several types of storage backends such "
4603
"as filestore, s3 etc. Glance has two components - <emphasis>glance-api and "
4604
"glance-registry</emphasis>. These can be controlled using the concerned "
4605
"upstart service jobs. For this specific case we will be using mysql as a "
4609
#: serverguide/C/virtualization.xml:1599(para)
4610
msgid "Install Glance"
4613
#: serverguide/C/virtualization.xml:1602(command)
4614
msgid "sudo apt-get install glance"
4617
#: serverguide/C/virtualization.xml:1605(para)
4618
msgid "Create a database and user for glance"
4621
#: serverguide/C/virtualization.xml:1608(command)
4622
msgid "sudo mysql -uroot -ppassword -e \"CREATE DATABASE glance;\""
4625
#: serverguide/C/virtualization.xml:1609(command)
4627
"sudo mysql -uroot -ppassword -e \"GRANT ALL ON glance.* TO "
4628
"glanceuser@localhost \\"
4631
#: serverguide/C/virtualization.xml:1610(command)
4632
msgid "IDENTIFIED BY 'glancepassword';\""
4635
#: serverguide/C/virtualization.xml:1613(para)
4637
"Edit the file /etc/glance/glance-registry.conf and edit the line which "
4638
"contains the option \"sql_connection =\" to this:"
4641
#: serverguide/C/virtualization.xml:1616(programlisting)
4643
msgid "sql_connection = mysql://glanceuser:glancepassword@localhost/glance"
4646
#: serverguide/C/virtualization.xml:1618(para)
4647
msgid "Remove the sqlite database"
4650
#: serverguide/C/virtualization.xml:1621(command)
4651
msgid "rm -rf /var/lib/glance/glance.sqlite"
4654
#: serverguide/C/virtualization.xml:1624(para)
4656
"Restart glance-registry after making changes to /etc/glance/glance-"
4657
"registry.conf. The MySQL database will be automatically populated."
4660
#: serverguide/C/virtualization.xml:1629(command)
4661
msgid "sudo restart glance-registry"
4664
#: serverguide/C/virtualization.xml:1632(para)
4666
"If you find issues take a look at the log file in /var/log/glance/api.log "
4667
"and /var/log/glance/registry.log."
4670
#: serverguide/C/virtualization.xml:1637(title)
4671
msgid "Running Instances"
4674
#: serverguide/C/virtualization.xml:1639(para)
4676
"Before you can instantiate images, you first need to setup user credentials. "
4677
"Once this first step is achieved you also need to upload images that you "
4678
"want to run in the cloud. Once you have these images uploaded to the cloud "
4679
"you will be able to run and connect to them. Here are the steps you should "
4680
"follow to get OpenStack Nova running instances:"
4683
#: serverguide/C/virtualization.xml:1646(para)
4684
msgid "Download, register and publish an Ubuntu cloud image"
4687
#: serverguide/C/virtualization.xml:1649(command)
4689
"wget http://cloud-images.ubuntu.com/saucy/current/saucy-server-cloudimg-"
4693
#: serverguide/C/virtualization.xml:1650(command)
4694
msgid "cloud-publish-tarball saucy-server-cloudimg-amd64.tar.gz saucy_amd64"
4697
#: serverguide/C/virtualization.xml:1653(para)
4698
msgid "Create a key pair and start an instance"
4701
#: serverguide/C/virtualization.xml:1656(command)
4705
#: serverguide/C/virtualization.xml:1658(command)
4706
msgid "euca-add-keypair user1 > user1.priv"
4709
#: serverguide/C/virtualization.xml:1659(command)
4710
msgid "chmod 0600 user1.priv"
4713
#: serverguide/C/virtualization.xml:1662(para)
4714
msgid "Allow icmp (ping) and ssh access to instances"
4717
#: serverguide/C/virtualization.xml:1665(command)
4718
msgid "euca-authorize default -P tcp -p 22 -s 0.0.0.0/0"
4721
#: serverguide/C/virtualization.xml:1666(command)
4722
msgid "euca-authorize -P icmp -t -1:-1 default"
4725
#: serverguide/C/virtualization.xml:1669(para)
4726
msgid "Run an instance"
4729
#: serverguide/C/virtualization.xml:1672(command)
4730
msgid "ami=`euca-describe-images | awk {'print $2'} | grep -m1 ami`"
4733
#: serverguide/C/virtualization.xml:1673(command)
4734
msgid "euca-run-instances $ami -k user1 -t m1.tiny"
4737
#: serverguide/C/virtualization.xml:1674(command) serverguide/C/virtualization.xml:1682(command)
4738
msgid "euca-describe-instances"
4741
#: serverguide/C/virtualization.xml:1677(para)
4742
msgid "Assign public address to the instance."
4745
#: serverguide/C/virtualization.xml:1680(command)
4746
msgid "euca-allocate-address"
4749
#: serverguide/C/virtualization.xml:1681(command)
4750
msgid "euca-associate-address -i instance_id public_ip_address"
4753
#: serverguide/C/virtualization.xml:1685(para)
4755
"You must enter above the <application>instance_id (ami)</application> and "
4756
"<application>public_ip_address</application> shown above by euca-describe-"
4757
"instances and euca-allocate-address commands."
4760
#: serverguide/C/virtualization.xml:1690(para)
4761
msgid "Now you should be able to SSH to the instance"
4764
#: serverguide/C/virtualization.xml:1693(application)
4768
#: serverguide/C/virtualization.xml:1693(command)
4769
msgid "ssh -i user1.priv ubuntu@<placeholder-1/>"
4772
#: serverguide/C/virtualization.xml:1696(para)
4773
msgid "To terminate instances"
4776
#: serverguide/C/virtualization.xml:1699(application)
4780
#: serverguide/C/virtualization.xml:1699(command)
4781
msgid "euca-terminate-instances <placeholder-1/>"
4784
#: serverguide/C/virtualization.xml:1704(title)
4785
msgid "Install the Storage Infrastructure (Swift)"
4788
#: serverguide/C/virtualization.xml:1706(para)
4790
"Swift is a highly available, distributed, eventually consistent object/blob "
4791
"store. It is used by the OpenStack Infrastructure to provide S3 like cloud "
4792
"storage services. It is also S3 api compatible with amazon."
4795
#: serverguide/C/virtualization.xml:1711(para)
4797
"Organizations use Swift to store lots of data efficiently, safely, and "
4798
"cheaply where applications use an special api to interface between the "
4799
"applications and objects stored in Swift."
4802
#: serverguide/C/virtualization.xml:1715(para)
4804
"Although you can install Swift on a single server, a multiple-server "
4805
"installation is required for production environments. If you want to install "
4806
"OpenStack Object Storage (Swift) on a single node for development or testing "
4807
"purposes, use the Swift All In One instructions on Ubuntu."
4810
#: serverguide/C/virtualization.xml:1721(para)
4812
"For more information see: <ulink "
4813
"url=\"http://swift.openstack.org/development_saio.html\">http://swift.opensta"
4814
"ck.org/development_saio.html </ulink> ."
4817
#: serverguide/C/virtualization.xml:1727(title)
4818
msgid "Support and Troubleshooting"
4821
#: serverguide/C/virtualization.xml:1729(para)
4822
4325
msgid "Community Support"
4825
#: serverguide/C/virtualization.xml:1733(ulink)
4328
#: serverguide/C/virtualization.xml:1391(ulink)
4826
4329
msgid "OpenStack Mailing list"
4829
#: serverguide/C/virtualization.xml:1738(ulink)
4332
#: serverguide/C/virtualization.xml:1396(ulink)
4830
4333
msgid "The OpenStack Wiki search"
4833
#: serverguide/C/virtualization.xml:1743(ulink)
4336
#: serverguide/C/virtualization.xml:1401(ulink)
4834
4337
msgid "Launchpad bugs area"
4837
#: serverguide/C/virtualization.xml:1748(para)
4340
#: serverguide/C/virtualization.xml:1406(para)
4838
4341
msgid "Join the IRC channel #openstack on freenode."
4841
#: serverguide/C/virtualization.xml:1759(ulink)
4344
#: serverguide/C/virtualization.xml:1417(ulink)
4842
4345
msgid "Cloud Computing - Service models"
4845
#: serverguide/C/virtualization.xml:1765(ulink)
4348
#: serverguide/C/virtualization.xml:1423(ulink)
4846
4349
msgid "OpenStack Compute"
4849
#: serverguide/C/virtualization.xml:1771(ulink)
4352
#: serverguide/C/virtualization.xml:1429(ulink)
4850
4353
msgid "OpenStack Image Service"
4853
#: serverguide/C/virtualization.xml:1777(ulink)
4356
#: serverguide/C/virtualization.xml:1435(ulink)
4854
4357
msgid "OpenStack Object Storage Administration Guide"
4857
#: serverguide/C/virtualization.xml:1783(ulink)
4360
#: serverguide/C/virtualization.xml:1441(ulink)
4858
4361
msgid "Installing OpenStack Object Storage on Ubuntu"
4861
#: serverguide/C/virtualization.xml:1789(ulink)
4364
#: serverguide/C/virtualization.xml:1447(ulink)
4862
4365
msgid "http://cloudglossary.com/"
4865
#: serverguide/C/virtualization.xml:1797(title)
4869
#: serverguide/C/virtualization.xml:1799(para)
4871
"The Ubuntu Cloud documentation uses terminology that might be unfamiliar to "
4872
"some readers. This page is intended to provide a glossary of such terms and "
4876
#: serverguide/C/virtualization.xml:1805(para)
4878
"<emphasis>Cloud</emphasis> - A federated set of physical machines that offer "
4879
"computing resources through virtual machines, provisioned and recollected "
4883
#: serverguide/C/virtualization.xml:1811(para)
4885
"<emphasis>IaaS</emphasis> - Infrastructure as a Service -- Cloud "
4886
"infrastructure services, whereby a virtualized environment is delivered as a "
4887
"service over the Internet by the provider. The infrastructure can include "
4888
"servers, network equipment, and software."
4891
#: serverguide/C/virtualization.xml:1819(para)
4892
msgid "<emphasis>EBS</emphasis> - Elastic Block Storage."
4895
#: serverguide/C/virtualization.xml:1823(para)
4897
"<emphasis>EC2</emphasis> - Elastic Compute Cloud. Amazon's pay-by-the-hour, "
4898
"pay-by-the-gigabyte public cloud computing offering."
4901
#: serverguide/C/virtualization.xml:1829(para)
4903
"<emphasis>Node</emphasis> - A node is a physical machine that's capable of "
4904
"running virtual machines, running a node controller. Within Ubuntu, this "
4905
"generally means that the CPU has VT extensions, and can run the KVM "
4909
#: serverguide/C/virtualization.xml:1836(para)
4911
"<emphasis>S3</emphasis> - Simple Storage Service. Amazon's pay-by-the-"
4912
"gigabyte persistent storage solution for EC2."
4915
#: serverguide/C/virtualization.xml:1841(para)
4917
"<emphasis>Ubuntu Cloud</emphasis> - Ubuntu Cloud. Ubuntu's cloud computing "
4918
"solution, based on OpenStack."
4921
#: serverguide/C/virtualization.xml:1846(para)
4922
msgid "<emphasis>VM</emphasis> - Virtual Machine."
4925
#: serverguide/C/virtualization.xml:1850(para)
4927
"<emphasis>VT</emphasis> - Virtualization Technology. An optional feature of "
4928
"some modern CPUs, allowing for accelerated virtual machine hosting."
4931
#: serverguide/C/virtualization.xml:1859(title)
4368
#: serverguide/C/virtualization.xml:1457(title)
4935
#: serverguide/C/virtualization.xml:1861(para)
4372
#: serverguide/C/virtualization.xml:1459(para)
4937
4374
"Containers are a lightweight virtualization technology. They are more akin "
4938
4375
"to an enhanced chroot than to full virtualization like Qemu or VMware, both "
4958
4392
"there are peculiarities which can cause confusion."
4961
#: serverguide/C/virtualization.xml:1883(para)
4395
#: serverguide/C/virtualization.xml:1478(para)
4963
4397
"In this document we will mainly describe the <application>lxc</application> "
4964
"package. Toward the end, we will describe how to use the libvirt LXC driver."
4398
"package. Use of libvirt-lxc is not generally recommended due to a lack of "
4399
"Apparmor protection for libvirt-lxc containers."
4967
#: serverguide/C/virtualization.xml:1887(para)
4402
#: serverguide/C/virtualization.xml:1483(para)
4968
4403
msgid "In this document, a container name will be shown as CN, C1, or C2."
4971
#: serverguide/C/virtualization.xml:1893(para)
4406
#: serverguide/C/virtualization.xml:1489(para)
4972
4407
msgid "The <application>lxc</application> package can be installed using"
4975
#: serverguide/C/virtualization.xml:1897(command)
4410
#: serverguide/C/virtualization.xml:1493(command)
4976
4411
msgid "sudo apt-get install lxc"
4979
#: serverguide/C/virtualization.xml:1902(para)
4981
"This will pull in the required and recommended dependencies, including "
4982
"cgroup-lite, lvm2, and debootstrap. To use libvirt-lxc, install libvirt-bin. "
4983
"LXC and libvirt-lxc can be installed and used at the same time."
4986
#: serverguide/C/virtualization.xml:1909(title)
4990
#: serverguide/C/virtualization.xml:1912(title)
4991
msgid "Basic layout of LXC files"
4994
#: serverguide/C/virtualization.xml:1914(para)
4996
"Following is a description of the files and directories which are installed "
5000
#: serverguide/C/virtualization.xml:1919(para)
5001
msgid "There are two upstart jobs:"
5004
#: serverguide/C/virtualization.xml:1925(para)
4414
#: serverguide/C/virtualization.xml:1498(para)
4416
"This will pull in the required and recommended dependencies, as well as set "
4417
"up a network bridge for containers to use. If you wish to use unprivileged "
4418
"containers, you will need to ensure that users have sufficient allocated "
4419
"subuids and subgids, and will likely want to allow users to connect "
4420
"containers to a bridge (see <xref linkend=\"lxc-unpriv\"/>)."
4423
#: serverguide/C/virtualization.xml:1508(title) serverguide/C/vcs.xml:104(title)
4427
#: serverguide/C/virtualization.xml:1509(para)
4429
"LXC can be used in two distinct ways - privileged, by running the lxc "
4430
"commands as the root user; or unprivileged, by running the lxc commands as a "
4431
"non-root user. (The starting of unprivileged containers by the root user is "
4432
"possible, but not described here.) Unprivileged containers are more limited, "
4433
"for instance being unable to create device nodes or mount block-backed "
4434
"filesystems. However they are less dangerous to the host, as the root userid "
4435
"in the container is mapped to a non-root userid on the host."
4438
#: serverguide/C/virtualization.xml:1521(title)
4439
msgid "Basic privileged usage"
4442
#: serverguide/C/virtualization.xml:1522(para)
4443
msgid "To create a privileged container, you can simply to"
4446
#: serverguide/C/virtualization.xml:1526(command)
4447
msgid "sudo lxc-create --template download --name u1"
4450
#: serverguide/C/virtualization.xml:1530(command)
4451
msgid "sudo lxc-create -t download -n u1"
4454
#: serverguide/C/virtualization.xml:1525(screen)
4458
"<placeholder-1/>\n"
4460
"<placeholder-2/>\n"
4463
#: serverguide/C/virtualization.xml:1534(para)
4465
"This will interactively ask for a container root filesystem type to download "
4466
"- in particular the distribution, release, and architecture. To create the "
4467
"container non-interactively, you can specify these values on the command "
4471
#: serverguide/C/virtualization.xml:1541(command)
4473
"sudo lxc-create -t download -n u1 -- --dist ubuntu --release trusty --arch "
4477
#: serverguide/C/virtualization.xml:1545(command)
4478
msgid "sudo lxc-create -t download -n u1 -- -d ubuntu -r trusty -a amd64"
4481
#: serverguide/C/virtualization.xml:1540(screen)
4485
"<placeholder-1/>\n"
4487
"<placeholder-2/>\n"
4490
#: serverguide/C/virtualization.xml:1550(para)
4492
"You can now use <command>lxc-ls</command> to list containers, <command>lxc-"
4493
"info</command> to obtain detailed container information, <command>lxc-"
4494
"start</command> to start and <command>lxc-stop</command> to stop the "
4495
"container. <command>lxc-attach</command> and <command>lxc-console</command> "
4496
"allow you to enter a container, if ssh is not an option. <command>lxc-"
4497
"destroy</command> removes the container, including its rootfs. See the "
4498
"manual pages for more information on each command. An example session might "
4502
#: serverguide/C/virtualization.xml:1561(command)
4504
"sudo lxc-ls --fancy sudo lxc-start --name u1 --daemon sudo lxc-info --name "
4505
"u1 sudo lxc-stop --name u1 sudo lxc-destroy --name u1"
4508
#: serverguide/C/virtualization.xml:1573(title)
4509
msgid "User namespaces"
4512
#: serverguide/C/virtualization.xml:1574(para)
4514
"Unprivileged containers allow users to create and administer containers "
4515
"without having any root privilege. The feature underpinning this is called "
4516
"user namespaces. User namespaces are hierarchical, with privileged tasks in "
4517
"a parent namespace being able to map its ids into child namespaces. By "
4518
"default every task on the host runs in the initial user namespace, where the "
4519
"full range of ids is mapped onto the full range. This can be seen by looking "
4520
"at /proc/self/uid_map and /proc/self/gid_map, which both will show \"0 0 "
4521
"4294967295\" when read from the initial user namespace. As of Ubuntu 14.04, "
4522
"when new users are created they are by default offered a range of userids. "
4523
"The list of assigned ids can be seen in the files "
4524
"<filename>/etc/subuid</filename> and <filename>/etc/subgid</filename> See "
4525
"their respective manpages for more information. Subuids and subgids are by "
4526
"convention started at id 100000 to avoid conflicting with system users."
4529
#: serverguide/C/virtualization.xml:1592(para)
4531
"If a user was created on an earlier release, it can be granted a range of "
4532
"ids using <command>usermod</command>, as follows:"
4535
#: serverguide/C/virtualization.xml:1597(command)
4536
msgid "sudo usermod -v 100000-200000 -w 100000-200000 user1"
4539
#: serverguide/C/virtualization.xml:1602(para)
4541
"The programs <command>newuidmap</command> and <command> newgidmap</command> "
4542
"are setuid-root programs in the <filename>uidmap</filename> package, which "
4543
"are used internally by lxc to map subuids and subgids from the host into the "
4544
"unprivileged container. They ensure that the user only maps ids which are "
4545
"authorized by the host configuration."
4548
#: serverguide/C/virtualization.xml:1613(title)
4549
msgid "Basic unprivileged usage"
4552
#: serverguide/C/virtualization.xml:1617(para)
4554
"To create unprivileged containers, a few first steps are needed. You will "
4555
"need to create a default container configuration file, specifying your "
4556
"desired id mappings and network setup, as well as configure the host to "
4557
"allow the unprivileged user to hook into the host network. The example below "
4558
"assumes that your mapped user and group id ranges are 100000-166000."
4561
#: serverguide/C/virtualization.xml:1626(command)
4563
"mkdir -p ~/.config/lxc echo \"lxc.id_map u 0 100000 66000\" > "
4564
"~/.config/lxc/default.conf echo \"lxc.id_map g 0 100000 66000\" >> "
4565
"~/.config/lxc/default.conf echo \"lxc.network.type = veth\" >> "
4566
"~/.config/lxc/default.conf echo \"lxc.network.link = lxcbr0\" >> "
4567
"~/.config/lxc/default.conf echo \"$USER veth lxcbr0 2\" >> "
4568
"/etc/lxc/lxc-usernet.conf"
4571
#: serverguide/C/virtualization.xml:1636(para)
4573
"After this, you can create unprivileged containers the same way as "
4574
"privileged ones, simply without using sudo."
4577
#: serverguide/C/virtualization.xml:1641(command)
4579
"lxc-create -t download -n u1 -- -d ubuntu -r trusty -a amd64 lxc-start -n u1 "
4580
"-d lxc-attach -n u1 lxc-stop -n u1 lxc-destroy -n u1"
4583
#: serverguide/C/virtualization.xml:1654(title)
4584
msgid "Global configuration"
4587
#: serverguide/C/virtualization.xml:1661(para)
4589
"<filename>lxc.conf</filename> may optionally specify alternate values for "
4590
"several lxc settings, including the lxcpath, the default configuration, "
4591
"cgroups to use, a cgroup creation pattern, and storage backend settings for "
4595
#: serverguide/C/virtualization.xml:1668(para)
4597
"<filename>default.conf</filename> specifies configuration which every newly "
4598
"created container should contain. This usually contains at least a network "
4599
"section, and, for unprivileged users, an id mapping section"
4602
#: serverguide/C/virtualization.xml:1675(para)
4604
"<filename>lxc-usernet.conf</filename> specifies how unprivileged users may "
4605
"connect their containers to the host-owned network."
4608
#: serverguide/C/virtualization.xml:1655(para)
4610
"The following configuration files are consulted by LXC. For privileged use, "
4611
"they are found under <filename>/etc/lxc</filename>, while for unprivileged "
4612
"use they are under <filename>~/.config/lxc</filename>. <placeholder-1/>"
4615
#: serverguide/C/virtualization.xml:1681(para)
4617
"<filename>lxc.conf</filename> and <filename>default.conf</filename> are "
4618
"exist both under <filename>/etc/lxc</filename> and "
4619
"<filename>$HOME/.config/lxc</filename>, while <filename>lxc-"
4620
"usernet.conf</filename> is only host-wide."
4623
#: serverguide/C/virtualization.xml:1686(para)
4625
"By default, containers are located under /var/lib/lxc for the root user, and "
4626
"$HOME/.local/share/lxc otherwise. The location can be specified for all lxc "
4627
"commands using the \"-P|--lxcpath\" argument."
4630
#: serverguide/C/virtualization.xml:1695(title) serverguide/C/network-config.xml:11(title)
4634
#: serverguide/C/virtualization.xml:1696(para)
4636
"By default LXC creates a private network namespace for each container, which "
4637
"includes a layer 2 networking stack. Containers usually connect to the "
4638
"outside world by either having a physical NIC or a veth tunnel endpoint "
4639
"passed into the container. LXC creates a NATed bridge, lxcbr0, at host "
4640
"startup. Containers created using the default configuration will have one "
4641
"veth NIC with the remote end plugged into the lxcbr0 bridge. A NIC can only "
4642
"exist in one namespace at a time, so a physical NIC passed into the "
4643
"container is not usable on the host."
4646
#: serverguide/C/virtualization.xml:1704(para)
4648
"It is possible to create a container without a private network namespace. In "
4649
"this case, the container will have access to the host networking like any "
4650
"other application. Note that this is particularly dangerous if the container "
4651
"is running a distribution with upstart, like Ubuntu, since programs which "
4652
"talk to init, like <command>shutdown</command>, will talk over the abstract "
4653
"Unix domain socket to the host's upstart, and shut down the host."
4656
#: serverguide/C/virtualization.xml:1711(para)
4658
"There are several ways to determine the ip address for a container. First, "
4659
"you can use <command>lxc-ls --fancy</command> which will print the ip "
4660
"addresses for all running containers, or <command>lxc-info -i -H -n "
4661
"C1</command> which will print C1's ip address. If dnsmasq is installedon the "
4662
"host, you can also add an entry to <filename>/etc/dnsmasq.conf</filename> as "
4663
"follows <screen>\n"
4664
"server=/lxc/10.0.3.1\n"
4665
"</screen> after which dnsmasq will resolve C1.lxc locally, so that you can "
4672
#: serverguide/C/virtualization.xml:1726(para)
4674
"For more information, see the lxc.conf manpage as well as the example "
4675
"network configurations under "
4676
"<filename>/usr/share/doc/lxc/examples/</filename>."
4679
#: serverguide/C/virtualization.xml:1732(title)
4683
#: serverguide/C/virtualization.xml:1734(para)
4685
"LXC does not have a long-running daemon. However it does have three upstart "
4689
#: serverguide/C/virtualization.xml:1740(para)
5006
4691
"<filename>/etc/init/lxc-net.conf:</filename> is an optional job which only "
5007
"runs if <filename> /etc/default/lxc</filename> specifies USE_LXC_BRIDGE "
4692
"runs if <filename> /etc/default/lxc-net</filename> specifies USE_LXC_BRIDGE "
5008
4693
"(true by default). It sets up a NATed bridge for containers to use."
5011
#: serverguide/C/virtualization.xml:1933(para)
5013
"<filename>/etc/init/lxc.conf:</filename> runs if LXC_AUTO (true by default) "
5014
"is set to true in <filename>/etc/default/lxc</filename>. It looks for "
5015
"entries under <filename>/etc/lxc/auto/</filename> which are symbolic links "
5016
"to configuration files for the containers which should be started at boot."
5019
#: serverguide/C/virtualization.xml:1944(para)
5021
"<filename>/etc/lxc/lxc.conf:</filename> There is a default container "
5022
"creation configuration file, <filename>/etc/lxc/lxc.conf</filename>, which "
5023
"directs containers to use the LXC bridge created by the lxc-net upstart job. "
5024
"If no configuration file is specified when creating a container, then this "
5028
#: serverguide/C/virtualization.xml:1953(para)
5030
"Examples of other container creation configuration files are found under "
5031
"<filename>/usr/share/doc/lxc/examples</filename>. These show how to create "
5032
"containers without a private network, or using macvlan, vlan, or other "
5036
#: serverguide/C/virtualization.xml:1960(para)
5038
"The various container administration tools are found under "
5039
"<filename>/usr/bin</filename>."
5042
#: serverguide/C/virtualization.xml:1965(para)
5044
"<filename>/usr/lib/lxc/lxc-init</filename> is a very minimal and lightweight "
5045
"init binary which is used by lxc-execute. Rather than `booting' a full "
5046
"container, it manually mounts a few filesystems, especially "
5047
"<filename>/proc</filename>, and executes its arguments. You are not likely "
5048
"to need to manually refer to this file."
5051
#: serverguide/C/virtualization.xml:1974(para)
5053
"<filename>/usr/lib/lxc/templates/</filename> contains the `templates' which "
5054
"can be used to create new containers of various distributions and flavors. "
5055
"Not all templates are currently supported."
5058
#: serverguide/C/virtualization.xml:1981(para)
5060
"<filename>/etc/apparmor.d/lxc/lxc-default</filename> contains the default "
5061
"Apparmor MAC policy which works to protect the host from containers. Please "
5062
"see the <xref linkend=\"lxc-apparmor\"/> for more information."
5065
#: serverguide/C/virtualization.xml:1988(para)
5067
"<filename>/etc/apparmor.d/usr.bin.lxc-start</filename> contains a profile to "
5068
"protect the host from <command>lxc-start</command> while it is setting up "
5072
#: serverguide/C/virtualization.xml:1995(para)
5074
"<filename>/etc/apparmor.d/lxc-containers</filename> causes all the profiles "
5075
"defined under <filename>/etc/apparmor.d/lxc</filename> to be loaded at boot."
5078
#: serverguide/C/virtualization.xml:2002(para)
5080
"There are various man pages for the LXC administration tools as well as the "
5081
"<filename>lxc.conf</filename> container configuration file."
5084
#: serverguide/C/virtualization.xml:2008(para)
5086
"<filename>/var/lib/lxc</filename> is where containers and their "
5087
"configuration information are stored."
5090
#: serverguide/C/virtualization.xml:2013(para)
5092
"<filename>/var/cache/lxc</filename> is where caches of distribution data are "
5093
"stored to speed up multiple container creations."
5096
#: serverguide/C/virtualization.xml:2021(title)
5100
#: serverguide/C/virtualization.xml:2023(para)
5102
"When USE_LXC_BRIDGE is set to true in /etc/default/lxc (as it is by "
5103
"default), a bridge called lxcbr0 is created at startup. This bridge is given "
5104
"the private address 10.0.3.1, and containers using this bridge will have a "
5105
"10.0.3.0/24 address. A dnsmasq instance is run listening on that bridge, so "
5106
"if another dnsmasq has bound all interfaces before the lxc-net upstart job "
5107
"runs, lxc-net will fail to start and lxcbr0 will not exist."
5110
#: serverguide/C/virtualization.xml:2031(para)
5112
"If you have another bridge - libvirt's default virbr0, or a br0 bridge for "
5113
"your default NIC - you can use that bridge in place of lxcbr0 for your "
5117
#: serverguide/C/virtualization.xml:2037(title)
5118
msgid "Using a separate filesystem for the container store"
5121
#: serverguide/C/virtualization.xml:2039(para)
5123
"LXC stores container information and (with the default backing store) root "
5124
"filesystems under <filename>/var/lib/lxc</filename>. Container creation "
5125
"templates also tend to store cached distribution information under "
5126
"<filename>/var/cache/lxc</filename>."
5129
#: serverguide/C/virtualization.xml:2044(para)
5131
"If you wish to use another filesystem than <filename>/var</filename>, you "
5132
"can mount a filesystem which has more space into those locations. If you "
5133
"have a disk dedicated for this, you can simply mount it at "
5134
"<filename>/var/lib/lxc</filename>. If you'd like to use another location, "
5135
"like <filename>/srv</filename>, you can bind mount it or use a symbolic "
5136
"link. For instance, if <filename>/srv</filename> is a large mounted "
5137
"filesystem, create and symlink two directories:"
5140
#: serverguide/C/virtualization.xml:2054(command)
5142
"sudo mkdir /srv/lxclib /srv/lxccache sudo rm -rf /var/lib/lxc /var/cache/lxc "
5143
"sudo ln -s /srv/lxclib /var/lib/lxc sudo ln -s /srv/lxccache /var/cache/lxc"
5146
#: serverguide/C/virtualization.xml:2062(para)
5147
msgid "or, using bind mounts:"
5150
#: serverguide/C/virtualization.xml:2065(command)
5152
"sudo mkdir /srv/lxclib /srv/lxccache sudo sed -i '$a \\ /srv/lxclib "
5153
"/var/lib/lxc none defaults,bind 0 0 \\ /srv/lxccache /var/cache/lxc none "
5154
"defaults,bind 0 0' /etc/fstab sudo mount -a"
5157
#: serverguide/C/virtualization.xml:2076(title)
5158
msgid "Containers backed by lvm"
5161
#: serverguide/C/virtualization.xml:2078(para)
5163
"It is possible to use LVM partitions as the backing stores for containers. "
5164
"Advantages of this include flexibility in storage management and fast "
5165
"container cloning. The tools default to using a VG (volume group) named "
5166
"<emphasis>lxc</emphasis>, but another VG can be used through command line "
5167
"options. When a LV is used as a container backing store, the container's "
5168
"configuration file is still <filename>/var/lib/lxc/CN/config</filename>, but "
5169
"the root fs entry in that file (<emphasis>lxc.rootfs</emphasis>) will point "
5170
"to the lV block device name, i.e. <filename>/dev/lxc/CN</filename>."
5173
#: serverguide/C/virtualization.xml:2088(para)
5174
msgid "Containers with directory tree and LVM backing stores can co-exist."
5177
#: serverguide/C/virtualization.xml:2093(title)
5181
#: serverguide/C/virtualization.xml:2095(para)
5183
"If your host has a btrfs <filename>/var</filename>, the LXC administration "
5184
"tools will detect this and automatically exploit it by cloning containers "
5185
"using btrfs snapshots."
5188
#: serverguide/C/virtualization.xml:2101(title)
4696
#: serverguide/C/virtualization.xml:1748(para)
4698
"<filename>/etc/init/lxc.conf</filename> loads the lxc apparmor profiles and "
4699
"optionally starts any autostart containers. The autostart containers will be "
4700
"ignored if LXC_AUTO (true by default) is set to true in "
4701
"<filename>/etc/default/lxc</filename>. See the lxc-autostart manual page for "
4702
"more information on autostarted containers."
4705
#: serverguide/C/virtualization.xml:1758(para)
4707
"<filename>/etc/init/lxc-instance.conf:</filename> is used by "
4708
"<filename>/etc/init/lxc.conf</filename> to autostart a container."
4711
#: serverguide/C/virtualization.xml:1767(title)
4712
msgid "Backing Stores"
4715
#: serverguide/C/virtualization.xml:1768(para)
4717
"LXC supports several backing stores for container root filesystems. The "
4718
"default is a simple directory backing store, because it requires no prior "
4719
"host customization, so long as the underlying filesystem is large enough. It "
4720
"also requires no root privilege to create the backing store, so that it is "
4721
"seamless for unprivileged use. The rootfs for a privileged directory backed "
4722
"container is located (by default) under "
4723
"<filename>/var/lib/lxc/C1/rootfs</filename>, while the rootfs for an "
4724
"unprivileged container is under "
4725
"<filename>~/.local/share/lxc/C1/rootfs</filename>. If a custom lxcpath is "
4726
"specified in lxc.system.com, then the container rootfs will be under "
4727
"<filename>$lxcpath/C1/rootfs</filename>."
4730
#: serverguide/C/virtualization.xml:1782(para)
4732
"A snapshot clone C2 of a a directory backed container C1 becomes an "
4733
"overlayfs backed container, with a rootfs called "
4734
"<filename>overlayfs:/var/lib/lxc/C1/rootfs:/var/lib/lxc/C2/delta0</filename>."
4735
" Other backing store types include loop, btrfs, LVM and zfs."
4738
#: serverguide/C/virtualization.xml:1790(para)
4740
"A btrfs backed container mostly looks like a directory backed container, "
4741
"with its root filesystem in the same location. However, the root filesystem "
4742
"comprises a subvolume, so that a snapshot clone is created using a subvolume "
4746
#: serverguide/C/virtualization.xml:1797(para)
4748
"The root filesystem for an LVM backed container can be any separate LV. The "
4749
"default VG name can be specified in lxc.conf. The filesystem type and size "
4750
"are configurable per-container using lxc-create."
4753
#: serverguide/C/virtualization.xml:1803(para)
4755
"The rootfs for a zfs backed container is a separate zfs filesystem, mounted "
4756
"under the traditional <filename>/var/lib/lxc/C1/rootfs</filename> location. "
4757
"The zfsroot can be specified at lxc-create, and a default can be specified "
4758
"in lxc.system.conf."
4761
#: serverguide/C/virtualization.xml:1810(para)
4763
"More information on creating containers with the various backing stores can "
4764
"be found in the lxc-create manual page."
4767
#: serverguide/C/virtualization.xml:1817(title)
4771
#: serverguide/C/virtualization.xml:1818(para)
4773
"Creating a container generally involves creating a root filesystem for the "
4774
"container. <command>lxc-create</command> delegates this work to "
4775
"<emphasis>templates</emphasis>, which are generally per-distribution. The "
4776
"lxc templates shipped with lxc can be found under "
4777
"<filename>/usr/share/lxc/templates</filename>, and include templates to "
4778
"create Ubuntu, Debian, Fedora, Oracle, centos, and gentoo containers among "
4782
#: serverguide/C/virtualization.xml:1827(para)
4784
"Creating distribution images in most cases requires the ability to create "
4785
"device nodes, often requires tools which are not available in other "
4786
"distributions, and usually is quite time-consuming. Therefore lxc comes with "
4787
"a special <emphasis>download</emphasis> template, which downloads pre-built "
4788
"container images from a central lxc server. The most important use case is "
4789
"to allow simple creation of unprivileged containers by non-root users, who "
4790
"could not for instance easily run the <command>debootstrap</command> command."
4793
#: serverguide/C/virtualization.xml:1837(para)
4795
"When running <command>lxc-create</command>, all options which come after "
4796
"<emphasis>--</emphasis> are passed to the template. In the following "
4797
"command, <emphasis>--name</emphasis>, <emphasis>--template</emphasis> and "
4798
"<emphasis>--bdev</emphasis> are passed to <command>lxc-create</command>, "
4799
"while <emphasis>--release</emphasis> is passed to the template: <screen>\n"
4801
"lxc-create --template ubuntu --name c1 --bdev loop -- --release trusty\n"
4806
#: serverguide/C/virtualization.xml:1849(para)
4808
"You can obtain help for the options supported by any particular container by "
4809
"passing <emphasis>--help</emphasis> and the template name to <command>lxc-"
4810
"create</command>. For instance, for help with the download template,"
4813
#: serverguide/C/virtualization.xml:1856(command)
4814
msgid "lxc-create --template download --help"
4817
#: serverguide/C/virtualization.xml:1862(title)
4821
#: serverguide/C/virtualization.xml:1863(para)
4823
"LXC supports marking containers to be started at system boot. Prior to "
4824
"Ubuntu 14.04, this was done using symbolic links under the directory "
4825
"<filename>/etc/lxc/auto</filename>. Starting with Ubuntu 14.04, it is done "
4826
"through the container configuration files. An entry <screen>\n"
4828
"lxc.start.auto = 1\n"
4829
"lxc.start.dely = 5\n"
4831
"</screen> would mean that the container should be started at boot, and the "
4832
"system should wait 5 seconds before starting the next container. LXC also "
4833
"supports ordering and grouping of containers, as well as reboot and shutdown "
4834
"by autostart groups. See the manual pages for lxc-autostart and "
4835
"lxc.container.conf for more information."
4838
#: serverguide/C/virtualization.xml:1881(title)
5189
4839
msgid "Apparmor"
5192
#: serverguide/C/virtualization.xml:2103(para)
4842
#: serverguide/C/virtualization.xml:1883(para)
5194
"LXC ships with an Apparmor profile intended to protect the host from "
4844
"LXC ships with a default Apparmor profile intended to protect the host from "
5195
4845
"accidental misuses of privilege inside the container. For instance, the "
5196
4846
"container will not be able to write to <filename>/proc/sysrq-"
5197
4847
"trigger</filename> or to most <filename>/sys</filename> files."
5200
#: serverguide/C/virtualization.xml:2109(para)
4850
#: serverguide/C/virtualization.xml:1889(para)
5202
4852
"The <filename>usr.bin.lxc-start</filename> profile is entered by running "
5203
4853
"<command>lxc-start</command>. This profile mainly prevents <command>lxc-"
5273
4935
"configuration file:"
5276
#: serverguide/C/virtualization.xml:2162(screen)
4938
#: serverguide/C/virtualization.xml:1952(screen)
5280
4942
"lxc.aa_profile = lxc-CN-profile\n"
5283
#: serverguide/C/virtualization.xml:2166(para)
4945
#: serverguide/C/virtualization.xml:1956(para)
5285
4947
"<command>lxc-execute</command> does not enter an Apparmor profile, but the "
5286
4948
"container it spawns will be confined."
5289
#: serverguide/C/virtualization.xml:2171(title)
4951
#: serverguide/C/virtualization.xml:1961(title) serverguide/C/cgroups.xml:11(title)
5290
4952
msgid "Control Groups"
5293
#: serverguide/C/virtualization.xml:2173(para)
4955
#: serverguide/C/virtualization.xml:1963(para)
5295
4957
"Control groups (cgroups) are a kernel feature providing hierarchical task "
5296
4958
"grouping and per-cgroup resource accounting and limits. They are used in "
5297
4959
"containers to limit block and character device access and to freeze "
5298
4960
"(suspend) containers. They can be further used to limit memory use and block "
5299
"i/o, guarantee minimum cpu shares, and to lock containers to specific cpus. "
5300
"By default, LXC depends on the cgroup-lite package to be installed, which "
5301
"provides the proper cgroup initialization at boot. The cgroup-lite package "
5302
"mounts each cgroup subsystem separately under "
5303
"<filename>/sys/fs/cgroup/SS</filename>, where SS is the subsystem name. For "
5304
"instance the freezer subsystem is mounted under "
5305
"<filename>/sys/fs/cgroup/freezer</filename>. LXC cgroup are kept under "
5306
"<filename>/sys/fs/cgroup/SS/INIT/lxc</filename>, where INIT is the init "
5307
"task's cgroup. This is <filename>/</filename> by default, so in the end the "
5308
"freezer cgroup for container CN would be "
5309
"<filename>/sys/fs/cgroup/freezer/lxc/CN</filename>."
5312
#: serverguide/C/virtualization.xml:2192(title)
5316
#: serverguide/C/virtualization.xml:2194(para)
5318
"The container administration tools must be run with root user privilege. A "
5319
"utility called <filename>lxc-setup</filename> was written with the intention "
5320
"of providing the tools with the needed file capabilities to allow non-root "
5321
"users to run the tools with sufficient privilege. However, as root in a "
5322
"container cannot yet be reliably contained, this is not worthwhile. It is "
5323
"therefore recommended to not use <filename>lxc-setup</filename>, and to "
5324
"provide the LXC administrators the needed sudo privilege."
5327
#: serverguide/C/virtualization.xml:2203(para)
5329
"The user namespace, which is expected to be available in the next Long Term "
5330
"Support (LTS) release, will allow containment of the container root user, as "
5331
"well as reduce the amount of privilege required for creating and "
5332
"administering containers."
5335
#: serverguide/C/virtualization.xml:2210(title)
5336
msgid "LXC Upstart Jobs"
5339
#: serverguide/C/virtualization.xml:2212(para)
5341
"As listed above, the <application>lxc</application> package includes two "
5342
"upstart jobs. The first, <filename>lxc-net</filename>, is always started "
5343
"when the other, <filename>lxc</filename>, is about to begin, and stops when "
5344
"it stops. If the USE_LXC_BRIDGE variable is set to false in "
5345
"<filename>/etc/defaults/lxc</filename>, then it will immediately exit. If it "
5346
"is true, and an error occurs bringing up the LXC bridge, then the "
5347
"<filename>lxc</filename> job will not start. <filename>lxc-net</filename> "
5348
"will bring down the LXC bridge when stopped, unless a container is running "
5349
"which is using that bridge."
5352
#: serverguide/C/virtualization.xml:2223(para)
5354
"The <filename>lxc</filename> job starts on runlevel 2-5. If the LXC_AUTO "
5355
"variable is set to true, then it will look under "
5356
"<filename>/etc/lxc</filename> for containers which should be started "
5357
"automatically. When the <filename>lxc</filename> job is stopped, either "
5358
"manually or by entering runlevel 0, 1, or 6, it will stop those containers."
5361
#: serverguide/C/virtualization.xml:2230(para)
5363
"To register a container to start automatically, create a symbolic link "
5364
"<filename>/etc/lxc/auto/name.conf</filename> pointing to the container's "
5365
"config file. For instance, the configuration file for a container "
5366
"<filename>CN</filename> is <filename>/var/lib/lxc/CN/config</filename>. To "
5367
"make that container auto-start, use the command:"
5370
#: serverguide/C/virtualization.xml:2238(command)
5371
msgid "sudo ln -s /var/lib/lxc/CN/config /etc/lxc/auto/CN.conf"
5374
#: serverguide/C/virtualization.xml:2246(title)
5375
msgid "Container Administration"
5378
#: serverguide/C/virtualization.xml:2249(title)
5379
msgid "Creating Containers"
5382
#: serverguide/C/virtualization.xml:2251(para)
5384
"The easiest way to create containers is using <command>lxc-create</command>. "
5385
"This script uses distribution-specific templates under "
5386
"<filename>/usr/lib/lxc/templates/</filename> to set up container-friendly "
5387
"chroots under <filename>/var/lib/lxc/CN/rootfs</filename>, and initialize "
5388
"the configuration in <filename>/var/lib/lxc/CN/fstab</filename> and "
5389
"<filename>/var/lib/lxc/CN/config</filename>, where CN is the container name"
5392
#: serverguide/C/virtualization.xml:2260(para)
5393
msgid "The simplest container creation command would look like:"
5396
#: serverguide/C/virtualization.xml:2263(command)
5397
msgid "sudo lxc-create -t ubuntu -n CN"
5400
#: serverguide/C/virtualization.xml:2268(para)
5402
"This tells lxc-create to use the ubuntu template (-t ubuntu) and to call the "
5403
"container CN (-n CN). Since no configuration file was specified (which would "
5404
"have been done with `-f file'), it will use the default configuration file "
5405
"under <filename>/etc/lxc/lxc.conf</filename>. This gives the container a "
5406
"single veth network interface attached to the lxcbr0 bridge."
5409
#: serverguide/C/virtualization.xml:2275(para)
5411
"The container creation templates can also accept arguments. These can be "
5412
"listed after --. For instance"
5415
#: serverguide/C/virtualization.xml:2279(command)
5416
msgid "sudo lxc-create -t ubuntu -n oneiric1 -- -r oneiric"
5419
#: serverguide/C/virtualization.xml:2284(para)
5420
msgid "passes the arguments '-r oneiric1' to the ubuntu template."
5423
#: serverguide/C/virtualization.xml:2288(title)
5427
#: serverguide/C/virtualization.xml:2290(para)
5429
"Help on the lxc-create command can be seen by using<command> lxc-create -"
5430
"h</command>. However, the templates also take their own options. If you do"
5433
#: serverguide/C/virtualization.xml:2295(command)
5434
msgid "sudo lxc-create -t ubuntu -h"
5437
#: serverguide/C/virtualization.xml:2300(para)
5439
"then the general <command>lxc-create</command> help will be followed by help "
5440
"output specific to the ubuntu template. If no template is specified, then "
5441
"only help for <command>lxc-create</command> itself will be shown."
5444
#: serverguide/C/virtualization.xml:2307(title)
5445
msgid "Ubuntu template"
5448
#: serverguide/C/virtualization.xml:2309(para)
5450
"The ubuntu template can be used to create Ubuntu system containers with any "
5451
"release at least as new as 10.04 LTS. It uses debootstrap to create a cached "
5452
"container filesystem which gets copied into place each time a container is "
5453
"created. The cached image is saved and only re-generated when you create a "
5454
"container using the <emphasis>-F</emphasis> (flush) option to the template, "
5458
#: serverguide/C/virtualization.xml:2317(command)
5459
msgid "sudo lxc-create -t ubuntu -n CN -- -F"
5462
#: serverguide/C/virtualization.xml:2322(para)
5464
"The Ubuntu release installed by the template will be the same as that on the "
5465
"host, unless otherwise specified with the <emphasis>-r</emphasis> option, "
5469
#: serverguide/C/virtualization.xml:2327(command)
5470
msgid "sudo lxc-create -t ubuntu -n CN -- -r lucid"
5473
#: serverguide/C/virtualization.xml:2332(para)
5475
"If you want to create a 32-bit container on a 64-bit host, pass <emphasis>-a "
5476
"i386</emphasis> to the container. If you have the qemu-user-static package "
5477
"installed, then you can create a container using any architecture supported "
5478
"by qemu-user-static."
5481
#: serverguide/C/virtualization.xml:2337(para)
5483
"The container will have a user named <emphasis>ubuntu</emphasis> whose "
5484
"password is <emphasis>ubuntu</emphasis> and who is a member of the "
5485
"<emphasis>sudo</emphasis> group. If you wish to inject a public ssh key for "
5486
"the <emphasis>ubuntu</emphasis> user, you can do so with <emphasis>-S "
5487
"sshkey.pub</emphasis>."
5490
#: serverguide/C/virtualization.xml:2344(para)
5492
"You can also <emphasis>bind</emphasis> user jdoe from the host into the "
5493
"container using the <emphasis>-b jdoe</emphasis> option. This will copy "
5494
"jdoe's password and shadow entries into the container, make sure his default "
5495
"group and shell are available, add him to the sudo group, and bind-mount his "
5496
"home directory into the container when the container is started."
5499
#: serverguide/C/virtualization.xml:2351(para)
5501
"When a container is created, the <filename>release-updates</filename> "
5502
"archive is added to the container's <filename>sources.list</filename>, and "
5503
"its package archive will be updated. If the container release is older than "
5504
"12.04 LTS, then the lxcguest package will be automatically installed. "
5505
"Alternatively, if the <emphasis>--trim</emphasis> option is specified, then "
5506
"the lxcguest package will not be installed, and many services will be "
5507
"removed from the container. This will result in a faster-booting, but less "
5508
"upgrade-able container."
5511
#: serverguide/C/virtualization.xml:2363(title)
5512
msgid "Ubuntu-cloud template"
5515
#: serverguide/C/virtualization.xml:2365(para)
5517
"The ubuntu-cloud template creates Ubuntu containers by downloading and "
5518
"extracting the published Ubuntu cloud images. It accepts some of the same "
5519
"options as the ubuntu template, namely <emphasis>-r release</emphasis>, "
5520
"<emphasis>-S sshkey.pub</emphasis>, <emphasis>-a arch</emphasis>, and "
5521
"<emphasis>-F</emphasis> to flush the cached image. It also accepts a few "
5522
"extra options. The <emphasis>-C</emphasis> option will create a "
5523
"<emphasis>cloud</emphasis> container, configured for use with a metadata "
5524
"service. The <emphasis>-u</emphasis> option accepts a cloud-init user-data "
5525
"file to configure the container on start. If <emphasis>-L</emphasis> is "
5526
"passed, then no locales will be installed. The <emphasis>-T</emphasis> "
5527
"option can be used to choose a tarball location to extract in place of the "
5528
"published cloud image tarball. Finally the <emphasis>-i</emphasis> option "
5529
"sets a host id for cloud-init, which by default is set to a random string."
5532
#: serverguide/C/virtualization.xml:2383(title)
5533
msgid "Other templates"
5536
#: serverguide/C/virtualization.xml:2385(para)
5538
"The ubuntu and ubuntu-cloud templates are well supported. Other templates "
5539
"are available however. The debian template creates a Debian based container, "
5540
"using debootstrap much as the ubuntu template does. By default it installs a "
5541
"<emphasis>debian squeeze</emphasis> image. An alternate release can be "
5542
"chosen by setting the SUITE environment variable, i.e.:"
5545
#: serverguide/C/virtualization.xml:2393(command)
5546
msgid "sudo SUITE=sid lxc-create -t debian -n d1"
5549
#: serverguide/C/virtualization.xml:2398(para)
5551
"To purge the container image cache, call the template directly and pass it "
5552
"the <emphasis>--clean</emphasis> option."
5555
#: serverguide/C/virtualization.xml:2402(command)
5556
msgid "sudo SUITE=sid /usr/lib/lxc/templates/lxc-debian --clean"
5559
#: serverguide/C/virtualization.xml:2407(para)
5561
"A fedora template exists, which creates containers based on fedora releases "
5562
"<= 14. Fedora release 15 and higher are based on systemd, which the "
5563
"template is not yet able to convert into a container-bootable setup. Before "
5564
"the fedora template is able to run, you'll need to make sure that "
5565
"<command>yum</command> and <command>curl</command> are installed. A fedora "
5566
"12 container can be created with"
5569
#: serverguide/C/virtualization.xml:2416(command)
5570
msgid "sudo lxc-create -t fedora -n fedora12 -- -R 12"
5573
#: serverguide/C/virtualization.xml:2421(para)
5575
"A OpenSuSE template exists, but it requires the <command>zypper</command> "
5576
"program, which is not yet packaged. The OpenSuSE template is therefore not "
5580
#: serverguide/C/virtualization.xml:2425(para)
5582
"Two more templates exist mainly for experimental purposes. The busybox "
5583
"template creates a very small system container based entirely on busybox. "
5584
"The sshd template creates an application container running sshd in a private "
5585
"network namespace. The host's library and binary directories are bind-"
5586
"mounted into the container, though not its <filename>/home</filename> or "
5587
"<filename>/root</filename>. To create, start, and ssh into an ssh container, "
5591
#: serverguide/C/virtualization.xml:2435(command)
5593
"sudo lxc-create -t sshd -n ssh1 ssh-keygen -f id sudo mkdir "
5594
"/var/lib/lxc/ssh1/rootfs/root/.ssh sudo cp id.pub "
5595
"/var/lib/lxc/ssh1/rootfs/root/.ssh/authorized_keys sudo lxc-start -n ssh1 -d "
5596
"ssh -i id root@ssh1."
5599
#: serverguide/C/virtualization.xml:2447(title)
5600
msgid "Backing Stores"
5603
#: serverguide/C/virtualization.xml:2449(para)
5605
"By default, <command>lxc-create</command> places the container's root "
5606
"filesystem as a directory tree at "
5607
"<filename>/var/lib/lxc/CN/rootfs</filename>. Another option is to use LVM "
5608
"logical volumes. If a volume group named <emphasis>lxc</emphasis> exists, "
5609
"you can create an lvm-backed container called CN using:"
5612
#: serverguide/C/virtualization.xml:2457(command)
5613
msgid "sudo lxc-create -t ubuntu -n CN -B lvm"
5616
#: serverguide/C/virtualization.xml:2462(para)
5618
"If you want to use a volume group named schroots, with a 5G xfs filesystem, "
5619
"then you would use"
5622
#: serverguide/C/virtualization.xml:2466(command)
5624
"sudo lxc-create -t ubuntu -n CN -B lvm --vgname schroots --fssize 5G --"
5628
#: serverguide/C/virtualization.xml:2474(title)
4961
"i/o, guarantee minimum cpu shares, and to lock containers to specific cpus."
4964
#: serverguide/C/virtualization.xml:1971(para)
4966
"By default, a privileged container CN will be assigned a cgroup called "
4967
"<filename>/lxc/CN</filename>. In the case of name conflicts (which can occur "
4968
"when using custom lxcpaths) a suffix \"-n\", where n is an integer starting "
4969
"at 0, will be appended to the cgroup name."
4972
#: serverguide/C/virtualization.xml:1977(para)
4974
"By default, a privileged container CN will be assigned a cgroup called "
4975
"<filename>CN</filename> under the cgroup of the task which started the "
4976
"container, for instance <filename>/usr/1000.user/1.session/CN</filename>. "
4977
"The container root will be given group ownership of the directory (but not "
4978
"all files) so that it is allowed to create new child cgroups."
4981
#: serverguide/C/virtualization.xml:1984(para)
4983
"As of Ubuntu 14.04, LXC uses the cgroup manager (cgmanager) to administer "
4984
"cgroups. The cgroup manager receives D-Bus requests over the Unix socket "
4985
"<filename>/sys/fs/cgroup/cgmanager/sock</filename>. To fascilitate safe "
4986
"nested containers, the line <screen>\n"
4988
"lxc.mount.auto = cgroup\n"
4990
"</screen> can be added to the container configuration causing the "
4991
"<filename>/sys/fs/cgroup/cgmanager</filename> directory to be bind-mounted "
4992
"into the container. The container in turn should start the cgroup management "
4993
"proxy (done by default if the cgmanager package is installed in the "
4994
"container) which will move the <filename>/sys/fs/cgroup/cgmanager</filename> "
4995
"directory to <filename>/sys/fs/cgroup/cgmanager.lower</filename>, then start "
4996
"listening for requests to proxy on its own socket "
4997
"<filename>/sys/fs/cgroup/cgmanager/sock</filename>. The host cgmanager will "
4998
"ensure that nested containers cannot escape their assigned cgroups or make "
4999
"requests for which they are not authorized."
5002
#: serverguide/C/virtualization.xml:2008(title)
5629
5003
msgid "Cloning"
5632
#: serverguide/C/virtualization.xml:2476(para)
5006
#: serverguide/C/virtualization.xml:2010(para)
5634
5008
"For rapid provisioning, you may wish to customize a canonical container "
5635
5009
"according to your needs and then make multiple copies of it. This can be "
5636
"done with the <command>lxc-clone</command> program. Given an existing "
5637
"container called C1, a new container called C2 can be created using:"
5640
#: serverguide/C/virtualization.xml:2483(command)
5010
"done with the <command>lxc-clone</command> program."
5013
#: serverguide/C/virtualization.xml:2014(para)
5015
"Clones are either snapshots or copies of another container. A copy is a new "
5016
"container copied from the original, and takes as much space on the host as "
5017
"the original. A snapshot exploits the underlying backing store's "
5018
"snapshotting ability to make a copy-on-write container referencing the "
5019
"first. Snapshots can be created from btrfs, LVM, zfs, and directory backed "
5020
"containers. Each backing store has its own peculiarities - for instance, LVM "
5021
"containers which are not thinpool-provisioned cannot support snapshots of "
5022
"snapshots; zfs containers with snapshots cannot be removed until all "
5023
"snapshots are released; LVM containers must be more carefully planned as the "
5024
"underlying filesystem may not support growing; btrfs does not suffer any of "
5025
"these shortcomings, but suffers from reduced fsync performance causing dpkg "
5026
"and apt-get to be slower."
5029
#: serverguide/C/virtualization.xml:2028(para)
5031
"Snapshots of directory-packed containers are created using the overlay "
5032
"filesystem. For instance, a privileged directory-backed container C1 will "
5033
"have its root filesystem under <filename>/var/lib/lxc/C1/rootfs</filename>. "
5034
"A snapshot clone of C1 called C2 will be started with C1's rootfs mounted "
5035
"readonly under <filename>/var/lib/lxc/C2/delta0</filename>. Importantly, in "
5036
"this case C1 should not be allowed to run or be removed while C2 is running. "
5037
"It is advised instead to consider C1 a <emphasis> canonical</emphasis> base "
5038
"container, and to only use its snapshots."
5041
#: serverguide/C/virtualization.xml:2040(para)
5042
msgid "Given an existing container called C1, a copy can be created using:"
5045
#: serverguide/C/virtualization.xml:2044(command)
5641
5046
msgid "sudo lxc-clone -o C1 -n C2"
5644
#: serverguide/C/virtualization.xml:2488(para)
5646
"If <filename>/var/lib/lxc</filename> is a btrfs filesystem, then "
5647
"<command>lxc-clone</command> will create C2's filesystem as a snapshot of "
5648
"C1's. If the container's root filesystem is lvm backed, then you can specify "
5649
"the <emphasis>-s</emphasis> option to create the new rootfs as a lvm "
5650
"snapshot of the original as follows:"
5049
#: serverguide/C/virtualization.xml:2049(para)
5050
msgid "A snapshot can be created using"
5653
#: serverguide/C/virtualization.xml:2495(command)
5053
#: serverguide/C/virtualization.xml:2051(command)
5654
5054
msgid "sudo lxc-clone -s -o C1 -n C2"
5657
#: serverguide/C/virtualization.xml:2500(para)
5659
"Both lvm and btrfs snapshots will provide fast cloning with very small "
5660
"initial disk usage."
5663
#: serverguide/C/virtualization.xml:2505(title)
5664
msgid "Starting and stopping"
5667
#: serverguide/C/virtualization.xml:2508(para)
5669
"The default login/password combination for the newly created container is "
5673
#: serverguide/C/virtualization.xml:2512(para)
5675
"To start a container, use <command>lxc-start -n CN</command>. By default "
5676
"<command>lxc-start</command> will execute <filename>/sbin/init</filename> in "
5677
"the container. You can provide a different program to execute, plus "
5678
"arguments, as further arguments to <command>lxc-start</command>:"
5681
#: serverguide/C/virtualization.xml:2519(command)
5682
msgid "sudo lxc-start -n container /sbin/init loglevel=debug"
5685
#: serverguide/C/virtualization.xml:2524(para)
5687
"If you do not specify the <emphasis>-d</emphasis> (daemon) option, then you "
5688
"will see a console (on the container's <filename>/dev/console</filename>, "
5689
"see <xref linkend=\"lxc-consoles\"/> for more information) on the terminal. "
5690
"If you specify the <emphasis>-d</emphasis> option, you will not see that "
5691
"console, and lxc-start will immediately exit success - even if a later part "
5692
"of container startup has failed. You can use <command>lxc-wait</command> or "
5693
"<command>lxc-monitor</command> (see <xref linkend=\"lxc-monitoring\"/>) to "
5694
"check on the success or failure of the container startup."
5697
#: serverguide/C/virtualization.xml:2535(para)
5699
"To obtain LXC debugging information, use <emphasis>-o filename -l "
5700
"debuglevel</emphasis>, for instance:"
5703
#: serverguide/C/virtualization.xml:2539(command)
5704
msgid "sudo lxc-start -o lxc.debug -l DEBUG -n container"
5707
#: serverguide/C/virtualization.xml:2544(para)
5709
"Finally, you can specify configuration parameters inline using <emphasis>-"
5710
"s</emphasis>. However, it is generally recommended to place them in the "
5711
"container's configuration file instead. Likewise, an entirely alternate "
5712
"config file can be specified with the <emphasis>-f</emphasis> option, but "
5713
"this is not generally recommended."
5716
#: serverguide/C/virtualization.xml:2551(para)
5718
"While <command>lxc-start</command> runs the container's "
5719
"<filename>/sbin/init</filename>, <command>lxc-execute</command> uses a "
5720
"minimal init program called <command>lxc-init</command>, which attempts to "
5721
"mount <filename>/proc</filename>, <filename>/dev/mqueue</filename>, and "
5722
"<filename>/dev/shm</filename>, executes the programs specified on the "
5723
"command line, and waits for those to finish executing. <command>lxc-"
5724
"start</command> is intended to be used for <emphasis>system "
5725
"containers</emphasis>, while <command>lxc-execute</command> is intended for "
5726
"<emphasis>application containers</emphasis> (see <ulink "
5727
"url=\"https://www.ibm.com/developerworks/linux/library/l-lxc-containers/\"> "
5728
"this article</ulink> for more)."
5731
#: serverguide/C/virtualization.xml:2564(para)
5733
"You can stop a container several ways. You can use "
5734
"<command>shutdown</command>, <command>poweroff</command> and "
5735
"<command>reboot</command> while logged into the container. To cleanly shut "
5736
"down a container externally (i.e. from the host), you can issue the "
5737
"<command>sudo lxc-shutdown -n CN</command> command. This takes an optional "
5738
"timeout value. If not specified, the command issues a SIGPWR signal to the "
5739
"container and immediately returns. If the option is used, as in "
5740
"<command>sudo lxc-shutdown -n CN -t 10</command>, then the command will wait "
5741
"the specified number of seconds for the container to cleanly shut down. "
5742
"Then, if the container is still running, it will kill it (and any running "
5743
"applications). You can also immediately kill the container (without any "
5744
"chance for applications to cleanly shut down) using <command>sudo lxc-stop -"
5745
"n CN</command>. Finally, <command>lxc-kill</command> can be used more "
5746
"generally to send any signal number to the container's init."
5749
#: serverguide/C/virtualization.xml:2580(para)
5751
"While the container is shutting down, you can expect to see some (harmless) "
5752
"error messages, as follows:"
5755
#: serverguide/C/virtualization.xml:2583(screen)
5760
"[sudo] password for ubuntu: =\n"
5764
"Broadcast message from ubuntu@cn1\n"
5765
" (/dev/lxc/console) at 18:17 ...\n"
5767
"The system is going down for power off NOW!\n"
5768
" * Asking all remaining processes to terminate...\n"
5770
" * All processes ended within 1 seconds....\n"
5772
" * Deconfiguring network interfaces...\n"
5774
" * Deactivating swap...\n"
5776
"umount: /run/lock: not mounted\n"
5777
"umount: /dev/shm: not mounted\n"
5778
"mount: / is busy\n"
5779
" * Will now halt\n"
5782
#: serverguide/C/virtualization.xml:2607(para)
5784
"A container can be frozen with <command>sudo lxc-freeze -n CN</command>. "
5785
"This will block all its processes until the container is later unfrozen "
5786
"using <command>sudo lxc-unfreeze -n CN</command>."
5789
#: serverguide/C/virtualization.xml:2614(title)
5057
#: serverguide/C/virtualization.xml:2055(para)
5058
msgid "See the lxc-clone manpage for more information."
5061
#: serverguide/C/virtualization.xml:2058(title)
5065
#: serverguide/C/virtualization.xml:2059(para)
5067
"To more easily support the use of snapshot clones for iterative container "
5068
"development, LXC supports <emphasis>snapshots</emphasis>. When working on a "
5069
"container C1, before making a potentially dangerous or hard-to-revert "
5070
"change, you can create a snapshot <screen>\n"
5072
"sudo lxc-snapshot -n C1\n"
5074
"</screen> which is a snapshot-clone called 'snap0' under /var/lib/lxcsnaps "
5075
"or $HOME/.local/share/lxcsnaps. The next snapshot will be called 'snap1', "
5076
"etc. Existing snapshots can be listed using <command>lxc-snapshot -L -n "
5077
"C1</command>, and a snapshot can be restored - erasing the current C1 "
5078
"container - using <command>lxc-snapshot -r snap1 -n C1</command>. After the "
5079
"restore command, the snap1 snapshot continues to exist, and the previous C1 "
5080
"is erased and replaced with the snap1 snapshot."
5083
#: serverguide/C/virtualization.xml:2078(para)
5085
"Snapshots are supported for btrfs, lvm, zfs, and overlayfs containers. If "
5086
"lxc-snapshot is called on a directory-backed container, an error will be "
5087
"logged and the snapshot will be created as a copy-clone. The reason for this "
5088
"is that if the user creates an overlayfs snapshot of a directory-backed "
5089
"container and then makes changes to the directory-backed container, then the "
5090
"original container changes will be partially reflected in the snapshot. If "
5091
"snapshots of a directory backed container C1 are desired, then an overlayfs "
5092
"clone of C1 should be created, C1 should not be touched again, and the "
5093
"overlayfs clone can be edited and snapshotted at will, as such <screen>\n"
5095
"lxc-clone -s -o C1 -n C2\n"
5096
"lxc-start -n C2 -d # make some changes\n"
5098
"lxc-snapshot -n C2\n"
5099
"lxc-start -n C2 # etc\n"
5104
#: serverguide/C/virtualization.xml:2102(title)
5105
msgid "Ephemeral Containers"
5108
#: serverguide/C/virtualization.xml:2103(para)
5110
"While snapshots are useful for longer-term incremental development of "
5111
"images, ephemeral containers utilize snapshots for quick, single-use "
5112
"throwaway containers. Given a base container C1, you can start an ephemeral "
5113
"container using <screen>\n"
5115
"lxc-start-ephemeral -o C1\n"
5117
"</screen> The container begins as a snapshot of C1. Instructions for logging "
5118
"into the container will be printed to the console. After shutdown, the "
5119
"ephemeral container will be destroyed. See the lxc-start-ephemeral manual "
5120
"page for more options."
5123
#: serverguide/C/virtualization.xml:2121(title)
5790
5124
msgid "Lifecycle management hooks"
5793
#: serverguide/C/virtualization.xml:2616(para)
5127
#: serverguide/C/virtualization.xml:2123(para)
5795
5129
"Beginning with Ubuntu 12.10, it is possible to define hooks to be executed "
5796
5130
"at specific points in a container's lifetime:"
5799
#: serverguide/C/virtualization.xml:2621(para)
5133
#: serverguide/C/virtualization.xml:2128(para)
5801
5135
"Pre-start hooks are run in the host's namespace before the container ttys, "
5802
5136
"consoles, or mounts are up. If any mounts are done in this hook, they should "
5803
5137
"be cleaned up in the post-stop hook."
5806
#: serverguide/C/virtualization.xml:2628(para)
5140
#: serverguide/C/virtualization.xml:2135(para)
5808
5142
"Pre-mount hooks are run in the container's namespaces, but before the root "
5809
5143
"filesystem has been mounted. Mounts done in this hook will be automatically "
5810
5144
"cleaned up when the container shuts down."
5813
#: serverguide/C/virtualization.xml:2635(para)
5147
#: serverguide/C/virtualization.xml:2142(para)
5815
5149
"Mount hooks are run after the container filesystems have been mounted, but "
5816
5150
"before the container has called <command>pivot_root</command> to change its "
5817
5151
"root filesystem."
5820
#: serverguide/C/virtualization.xml:2642(para)
5154
#: serverguide/C/virtualization.xml:2149(para)
5822
5156
"Start hooks are run immediately before executing the container's init. Since "
5823
5157
"these are executed after pivoting into the container's filesystem, the "
5824
5158
"command to be executed must be copied into the container's filesystem."
5827
#: serverguide/C/virtualization.xml:2649(para)
5161
#: serverguide/C/virtualization.xml:2156(para)
5828
5162
msgid "Post-stop hooks are executed after the container has been shut down."
5831
#: serverguide/C/virtualization.xml:2654(para)
5165
#: serverguide/C/virtualization.xml:2161(para)
5833
5167
"If any hook returns an error, the container's run will be aborted. Any "
5834
5168
"<emphasis>post-stop</emphasis> hook will still be executed. Any output "
5835
5169
"generated by the script will be logged at the debug priority."
5838
#: serverguide/C/virtualization.xml:2659(para)
5840
"See <xref linkend=\"lxc-conf-other\"/> for the configuration file format "
5841
"with which to specify hooks. Some sample hooks are shipped with the lxc "
5842
"package to serve as an example of how to write and use such hooks."
5845
#: serverguide/C/virtualization.xml:2666(title)
5846
msgid "Monitoring container status"
5849
#: serverguide/C/virtualization.xml:2668(para)
5851
"Two commands are available to monitor container state changes. <command>lxc-"
5852
"monitor</command> monitors one or more containers for any state changes. It "
5853
"takes a container name as usual with the <emphasis>-n</emphasis> option, but "
5854
"in this case the container name can be a posix regular expression to allow "
5855
"monitoring desirable sets of containers. <command>lxc-monitor</command> "
5856
"continues running as it prints container changes. <command>lxc-"
5857
"wait</command> waits for a specific state change and then exits. For "
5861
#: serverguide/C/virtualization.xml:2678(command)
5862
msgid "sudo lxc-monitor -n cont[0-5]*"
5865
#: serverguide/C/virtualization.xml:2683(para)
5867
"would print all state changes to any containers matching the listed regular "
5868
"expression, whereas"
5871
#: serverguide/C/virtualization.xml:2687(command)
5872
msgid "sudo lxc-wait -n cont1 -s 'STOPPED|FROZEN'"
5875
#: serverguide/C/virtualization.xml:2692(para)
5877
"will wait until container cont1 enters state STOPPED or state FROZEN and "
5881
#: serverguide/C/virtualization.xml:2697(title)
5172
#: serverguide/C/virtualization.xml:2166(para)
5174
"Please see the lxc.container.conf manual page for the configuration file "
5175
"format with which to specify hooks. Some sample hooks are shipped with the "
5176
"lxc package to serve as an example of how to write and use such hooks."
5179
#: serverguide/C/virtualization.xml:2173(title)
5882
5180
msgid "Consoles"
5885
#: serverguide/C/virtualization.xml:2699(para)
5183
#: serverguide/C/virtualization.xml:2175(para)
5887
5185
"Containers have a configurable number of consoles. One always exists on the "
5888
5186
"container's <filename>/dev/console</filename>. This is shown on the terminal "
5922
5220
"<filename>/dev</filename>."
5925
#: serverguide/C/virtualization.xml:2735(title)
5926
msgid "Container Inspection"
5929
#: serverguide/C/virtualization.xml:2737(para)
5931
"Several commands are available to gather information on existing containers. "
5932
"<command>lxc-ls</command> will report all existing containers in its first "
5933
"line of output, and all running containers in the second line. <command>lxc-"
5934
"list</command> provides the same information in a more verbose format, "
5935
"listing running containers first and stopped containers next. <command>lxc-"
5936
"ps</command> will provide lists of processes in containers. To provide "
5937
"<command>ps</command> arguments to <command>lxc-ps</command>, prepend them "
5938
"with <command>--</command>. For instance, for listing of all processes in "
5942
#: serverguide/C/virtualization.xml:2749(command)
5943
msgid "sudo lxc-ps -n plain -- -ef"
5946
#: serverguide/C/virtualization.xml:2754(para)
5948
"<command>lxc-info</command> provides the state of a container and the pid of "
5949
"its init process. <command>lxc-cgroup</command> can be used to query or set "
5950
"the values of a container's control group limits and information. This can "
5951
"be more convenient than interacting with the <command>cgroup</command> "
5952
"filesystem. For instance, to query the list of devices which a running "
5953
"container is allowed to access, you could use"
5956
#: serverguide/C/virtualization.xml:2763(command)
5957
msgid "sudo lxc-cgroup -n CN devices.list"
5960
#: serverguide/C/virtualization.xml:2768(para)
5962
"or to add mknod, read, and write access to <filename>/dev/sda</filename>,"
5965
#: serverguide/C/virtualization.xml:2772(command)
5966
msgid "sudo lxc-cgroup -n CN devices.allow \"b 8:* rwm\""
5969
#: serverguide/C/virtualization.xml:2777(para)
5970
msgid "and, to limit it to 300M of RAM,"
5973
#: serverguide/C/virtualization.xml:2780(command)
5974
msgid "lxc-cgroup -n CN memory.limit_in_bytes 300000000"
5977
#: serverguide/C/virtualization.xml:2785(para)
5979
"<command>lxc-netstat</command> executes <command>netstat</command> in the "
5980
"running container, giving you a glimpse of its network state."
5983
#: serverguide/C/virtualization.xml:2789(para)
5985
"<command>lxc-backup</command> will create backups of the root filesystems of "
5986
"all existing containers (except lvm-based ones), using "
5987
"<command>rsync</command> to back the contents up under "
5988
"<filename>/var/lib/lxc/CN/rootfs.backup.1</filename>. These backups can be "
5989
"restored using <command>lxc-restore.</command> However, <command>lxc-"
5990
"backup</command> and <command>lxc-restore</command> are fragile with respect "
5991
"to customizations and therefore their use is not recommended."
5994
#: serverguide/C/virtualization.xml:2800(title)
5995
msgid "Destroying containers"
5998
#: serverguide/C/virtualization.xml:2802(para)
5999
msgid "Use <command>lxc-destroy</command> to destroy an existing container."
6002
#: serverguide/C/virtualization.xml:2806(command)
6003
msgid "sudo lxc-destroy -n CN"
6006
#: serverguide/C/virtualization.xml:2811(para)
6008
"If the container is running, <command>lxc-destroy</command> will exit with a "
6009
"message informing you that you can force stopping and destroying the "
6013
#: serverguide/C/virtualization.xml:2816(command)
6014
msgid "sudo lxc-destroy -n CN -f"
6017
#: serverguide/C/virtualization.xml:2823(title)
6018
msgid "Advanced namespace usage"
6021
#: serverguide/C/virtualization.xml:2825(para)
6023
"One of the Linux kernel features used by LXC to create containers is private "
6024
"namespaces. Namespaces allow a set of tasks to have private mappings of "
6025
"names to resources for things like pathnames and process IDs. (See <xref "
6026
"linkend=\"lxc-resources\"/> for a link to more information). Unlike control "
6027
"groups and other mount features which are also used to create containers, "
6028
"namespaces cannot be manipulated using a filesystem interface. Therefore, "
6029
"LXC ships with the <command>lxc-unshare</command> program, which is mainly "
6030
"for testing. It provides the ability to create new tasks in private "
6031
"namespaces. For instance,"
6034
#: serverguide/C/virtualization.xml:2837(command)
6035
msgid "sudo lxc-unshare -s 'MOUNT|PID' /bin/bash"
6038
#: serverguide/C/virtualization.xml:2842(para)
6040
"creates a bash shell with private pid and mount namespaces. In this shell, "
6044
#: serverguide/C/virtualization.xml:2845(screen)
6048
"root@ubuntu:~# mount -t proc proc /proc\n"
6049
"root@ubuntu:~# ps -ef\n"
6050
"UID PID PPID C STIME TTY TIME CMD\n"
6051
"root 1 0 6 10:20 pts/9 00:00:00 /bin/bash\n"
6052
"root 110 1 0 10:20 pts/9 00:00:00 ps -ef\n"
6055
#: serverguide/C/virtualization.xml:2853(para)
6057
"so that <command>ps</command> shows only the tasks in your new namespace."
6060
#: serverguide/C/virtualization.xml:2858(title)
6061
msgid "Ephemeral containers"
6064
#: serverguide/C/virtualization.xml:2860(para)
6066
"Ephemeral containers are one-time containers. Given an existing container "
6067
"CN, you can run a command in an ephemeral container created based on CN, "
6068
"with the host's jdoe user bound into the container, using:"
6071
#: serverguide/C/virtualization.xml:2866(command)
6072
msgid "lxc-start-ephemeral -b jdoe -o CN -- /home/jdoe/run_my_job"
6075
#: serverguide/C/virtualization.xml:2871(para)
6076
msgid "When the job is finished, the container will be discarded."
6079
#: serverguide/C/virtualization.xml:2876(title)
6080
msgid "Container Commands"
6083
#: serverguide/C/virtualization.xml:2878(para)
6084
msgid "Following is a table of all container commands:"
6087
#: serverguide/C/virtualization.xml:2881(title)
6088
msgid "Container commands"
6091
#: serverguide/C/virtualization.xml:2890(para)
6095
#: serverguide/C/virtualization.xml:2892(para)
6099
#: serverguide/C/virtualization.xml:2898(para)
6103
#: serverguide/C/virtualization.xml:2900(para)
6104
msgid "(NOT SUPPORTED) Run a command in a running container"
6107
#: serverguide/C/virtualization.xml:2905(para)
6111
#: serverguide/C/virtualization.xml:2907(para)
6112
msgid "Back up the root filesystems for all lvm-backed containers"
6115
#: serverguide/C/virtualization.xml:2912(para)
6119
#: serverguide/C/virtualization.xml:2914(para)
6120
msgid "View and set container control group settings"
6123
#: serverguide/C/virtualization.xml:2919(para)
6124
msgid "lxc-checkconfig"
6127
#: serverguide/C/virtualization.xml:2921(para)
6128
msgid "Verify host support for containers"
6131
#: serverguide/C/virtualization.xml:2925(para)
6132
msgid "lxc-checkpoint"
6135
#: serverguide/C/virtualization.xml:2927(para)
6136
msgid "(NOT SUPPORTED) Checkpoint a running container"
6139
#: serverguide/C/virtualization.xml:2932(para)
6143
#: serverguide/C/virtualization.xml:2934(para)
6144
msgid "Clone a new container from an existing one"
6147
#: serverguide/C/virtualization.xml:2939(para)
6151
#: serverguide/C/virtualization.xml:2941(para)
6152
msgid "Open a console in a running container"
6155
#: serverguide/C/virtualization.xml:2946(para)
6159
#: serverguide/C/virtualization.xml:2948(para)
6160
msgid "Create a new container"
6163
#: serverguide/C/virtualization.xml:2952(para)
6167
#: serverguide/C/virtualization.xml:2954(para)
6168
msgid "Destroy an existing container"
6171
#: serverguide/C/virtualization.xml:2958(para)
6175
#: serverguide/C/virtualization.xml:2960(para)
6176
msgid "Run a command in a (not running) application container"
6179
#: serverguide/C/virtualization.xml:2965(para)
6183
#: serverguide/C/virtualization.xml:2967(para)
6184
msgid "Freeze a running container"
6187
#: serverguide/C/virtualization.xml:2971(para)
6191
#: serverguide/C/virtualization.xml:2973(para)
6192
msgid "Print information on the state of a container"
6195
#: serverguide/C/virtualization.xml:2978(para)
6199
#: serverguide/C/virtualization.xml:2980(para)
6200
msgid "Send a signal to a container's init"
6203
#: serverguide/C/virtualization.xml:2985(para)
6207
#: serverguide/C/virtualization.xml:2987(para)
6208
msgid "List all containers"
6211
#: serverguide/C/virtualization.xml:2991(para)
6215
#: serverguide/C/virtualization.xml:2993(para)
6216
msgid "List all containers with shorter output than lxc-list"
6219
#: serverguide/C/virtualization.xml:2998(para)
6223
#: serverguide/C/virtualization.xml:3000(para)
6224
msgid "Monitor state changes of one or more containers"
6227
#: serverguide/C/virtualization.xml:3005(para)
6231
#: serverguide/C/virtualization.xml:3007(para)
6232
msgid "Execute netstat in a running container"
6235
#: serverguide/C/virtualization.xml:3012(para)
6239
#: serverguide/C/virtualization.xml:3014(para)
6240
msgid "View process info in a running container"
6243
#: serverguide/C/virtualization.xml:3019(para)
6247
#: serverguide/C/virtualization.xml:3021(para)
6248
msgid "(NOT SUPPORTED) Restart a checkpointed container"
6251
#: serverguide/C/virtualization.xml:3026(para)
6255
#: serverguide/C/virtualization.xml:3028(para)
6256
msgid "Restore containers from backups made by lxc-backup"
6259
#: serverguide/C/virtualization.xml:3033(para)
6263
#: serverguide/C/virtualization.xml:3035(para)
6264
msgid "(NOT RECOMMENDED) Set file capabilities on LXC tools"
6267
#: serverguide/C/virtualization.xml:3040(para)
6271
#: serverguide/C/virtualization.xml:3042(para)
6272
msgid "(NOT RECOMMENDED) Set or remove setuid bits on LXC tools"
6275
#: serverguide/C/virtualization.xml:3047(para)
6276
msgid "lxc-shutdown"
6279
#: serverguide/C/virtualization.xml:3049(para)
6280
msgid "Safely shut down a container"
6283
#: serverguide/C/virtualization.xml:3053(para)
6287
#: serverguide/C/virtualization.xml:3055(para)
6288
msgid "Start a stopped container"
6291
#: serverguide/C/virtualization.xml:3059(para)
6292
msgid "lxc-start-ephemeral"
6295
#: serverguide/C/virtualization.xml:3061(para)
6296
msgid "Start an ephemeral (one-time) container"
6299
#: serverguide/C/virtualization.xml:3066(para)
6303
#: serverguide/C/virtualization.xml:3068(para)
6304
msgid "Immediately stop a running container"
6307
#: serverguide/C/virtualization.xml:3073(para)
6308
msgid "lxc-unfreeze"
6311
#: serverguide/C/virtualization.xml:3075(para)
6312
msgid "Unfreeze a frozen container"
6315
#: serverguide/C/virtualization.xml:3079(para)
6319
#: serverguide/C/virtualization.xml:3081(para)
6320
msgid "Testing tool to manually unshare namespaces"
6323
#: serverguide/C/virtualization.xml:3086(para)
6327
#: serverguide/C/virtualization.xml:3088(para)
6328
msgid "Print the version of the LXC tools"
6331
#: serverguide/C/virtualization.xml:3092(para)
6335
#: serverguide/C/virtualization.xml:3094(para)
6336
msgid "Wait for a container to reach a particular state"
6339
#: serverguide/C/virtualization.xml:3104(title)
6340
msgid "Configuration File"
6343
#: serverguide/C/virtualization.xml:3106(para)
6345
"LXC containers are very flexible. The Ubuntu <application>lxc</application> "
6346
"package sets defaults to make creation of Ubuntu system containers as simple "
6347
"as possible. If you need more flexibility, this chapter will show how to "
6348
"fine-tune your containers as you need."
6351
#: serverguide/C/virtualization.xml:3112(para)
6353
"Detailed information is available in the <command>lxc.conf(5)</command> man "
6354
"page. Note that the default configurations created by the ubuntu templates "
6355
"are reasonable for a system container and usually do not need customization."
6358
#: serverguide/C/virtualization.xml:3118(title)
6359
msgid "Choosing configuration files and options"
6362
#: serverguide/C/virtualization.xml:3120(para)
6364
"The container setup is controlled by the LXC configuration options. Options "
6365
"can be specified at several points:"
6368
#: serverguide/C/virtualization.xml:3125(para)
6370
"During container creation, a configuration file can be specified. However, "
6371
"creation templates often insert their own configuration options, so we "
6372
"usually specify only network configuration options at this point. For other "
6373
"configuration, it is usually better to edit the configuration file after "
6374
"container creation."
6377
#: serverguide/C/virtualization.xml:3134(para)
6379
"The file <filename>/var/lib/lxc/CN/config</filename> is used at container "
6380
"startup by default."
6383
#: serverguide/C/virtualization.xml:3139(para)
6385
"<command>lxc-start</command> accepts an alternate configuration file with "
6386
"the <emphasis>-f filename</emphasis> option."
6389
#: serverguide/C/virtualization.xml:3145(para)
6391
"Specific configuration variables can be overridden at <command>lxc-"
6392
"start</command> using <emphasis>-s key=value</emphasis>. It is generally "
6393
"better to edit the container configuration file."
6396
#: serverguide/C/virtualization.xml:3154(title) serverguide/C/network-config.xml:25(title)
6397
msgid "Network Configuration"
6400
#: serverguide/C/virtualization.xml:3156(para)
6402
"Container networking in LXC is very flexible. It is triggered by the "
6403
"<command>lxc.network.type</command> configuration file entries. If no such "
6404
"entries exist, then the container will share the host's networking stack. "
6405
"Services and connections started in the container will be using the host's "
6406
"IP address. If at least one <command>lxc.network.type</command> entry is "
6407
"present, then the container will have a private (layer 2) network stack. It "
6408
"will have its own network interfaces and firewall rules. There are several "
6409
"options for <command>lxc.network.type</command>:"
6412
#: serverguide/C/virtualization.xml:3168(para)
6414
"<command>lxc.network.type=empty</command>: The container will have no "
6415
"network interfaces other than loopback."
6418
#: serverguide/C/virtualization.xml:3173(para)
6420
"<command>lxc.network.type=veth</command>: This is the default when using the "
6421
"ubuntu or ubuntu-cloud templates, and creates a veth network tunnel. One end "
6422
"of this tunnel becomes the network interface inside the container. The other "
6423
"end is attached to a bridged on the host. Any number of such tunnels can be "
6424
"created by adding more <command>lxc.network.type=veth</command> entries in "
6425
"the container configuration file. The bridge to which the host end of the "
6426
"tunnel will be attached is specified with <command>lxc.network.link = "
6430
#: serverguide/C/virtualization.xml:3185(para)
6432
"<command>lxc.network.type=phys</command> A physical network interface (i.e. "
6433
"eth2) is passed into the container."
6436
#: serverguide/C/virtualization.xml:3190(para)
6438
"Two other options are to use vlan or macvlan, however their use is more "
6439
"complicated and is not described here. A few other networking options exist:"
6442
#: serverguide/C/virtualization.xml:3196(para)
6444
"<command>lxc.network.flags</command> can only be set to "
6445
"<emphasis>up</emphasis> and ensures that the network interface is up."
6448
#: serverguide/C/virtualization.xml:3202(para)
6450
"<command>lxc.network.hwaddr</command> specifies a mac address to assign to "
6451
"the nic inside the container."
6454
#: serverguide/C/virtualization.xml:3207(para)
6456
"<command>lxc.network.ipv4</command> and <command>lxc.network.ipv6</command> "
6457
"set the respective IP addresses, if those should be static."
6460
#: serverguide/C/virtualization.xml:3213(para)
6462
"<command>lxc.network.name</command> specifies a name to assign inside the "
6463
"container. If this is not specified, a good default (i.e. eth0 for the first "
6467
#: serverguide/C/virtualization.xml:3219(para)
6469
"<command>lxc.network.lxcscript.up</command> specifies a script to be called "
6470
"after the host side of the networking has been set up. See the "
6471
"<command>lxc.conf(5)</command> manual page for details."
6474
#: serverguide/C/virtualization.xml:3228(title)
6475
msgid "Control group configuration"
6478
#: serverguide/C/virtualization.xml:3230(para)
6480
"Cgroup options can be specified using <command>lxc.cgroup</command> entries. "
6481
"<command>lxc.cgroup.subsystem.item = value</command> instructs LXC to set "
6482
"cgroup <command>subsystem</command>'s <command>item</command> to "
6483
"<command>value</command>. It is perhaps simpler to realize that this will "
6484
"simply write <command>value</command> to the file <command>item</command> "
6485
"for the container's control group for subsystem "
6486
"<command>subsystem</command>. For instance, to set the memory limit to 320M, "
6490
#: serverguide/C/virtualization.xml:3241(command)
6491
msgid "lxc.cgroup.memory.limit_in_bytes = 320000000"
6494
#: serverguide/C/virtualization.xml:3246(para)
6496
"which will cause 320000000 to be written to the file "
6497
"<filename>/sys/fs/cgroup/memory/lxc/CN/limit_in_bytes</filename>."
6500
#: serverguide/C/virtualization.xml:3251(title)
6501
msgid "Rootfs, mounts and fstab"
6504
#: serverguide/C/virtualization.xml:3253(para)
6506
"An important part of container setup is the mounting of various filesystems "
6507
"into place. The following is an example configuration file excerpt "
6508
"demonstrating the commonly used configuration options:"
6511
#: serverguide/C/virtualization.xml:3258(command)
6513
"lxc.rootfs = /var/lib/lxc/CN/rootfs lxc.mount.entry=proc "
6514
"/var/lib/lxc/CN/rootfs/proc proc nodev,noexec,nosuid 0 0 lxc.mount = "
6515
"/var/lib/lxc/CN/fstab"
6518
#: serverguide/C/virtualization.xml:3265(para)
6520
"The first line says that the container's root filesystem is already mounted "
6521
"at <filename>/var/lib/lxc/CN/rootfs</filename>. If the filesystem is a block "
6522
"device (such as an LVM logical volume), then the path to the block device "
6523
"must be given instead."
6526
#: serverguide/C/virtualization.xml:3270(para)
6528
"Each <command>lxc.mount.entry</command> line should contain an item to mount "
6529
"in valid fstab format. The target directory should be prefixed by "
6530
"<filename>/var/lib/lxc/CN/rootfs</filename>, even if "
6531
"<command>lxc.rootfs</command> points to a block device."
6534
#: serverguide/C/virtualization.xml:3275(para)
6536
"Finally, <command>lxc.mount</command> points to a file, in fstab format, "
6537
"containing further items to mount. Note that all of these entries will be "
6538
"mounted by the host before the container init is started. In this way it is "
6539
"possible to bind mount various directories from the host into the container."
6542
#: serverguide/C/virtualization.xml:3283(title)
6543
msgid "Other configuration options"
6546
#: serverguide/C/virtualization.xml:3287(para)
6548
"<command>lxc.cap.drop</command> can be used to prevent the container from "
6549
"having or ever obtaining the listed capabilities. For instance, including"
6552
#: serverguide/C/virtualization.xml:3292(command)
6553
msgid "lxc.cap.drop = sys_admin"
6556
#: serverguide/C/virtualization.xml:3297(para)
6558
"will prevent the container from mounting filesystems, as well as all other "
6559
"actions which require cap_sys_admin. See the "
6560
"<command>capabilities(7)</command> manual page for a list of capabilities "
6561
"and their meanings."
6564
#: serverguide/C/virtualization.xml:3304(para)
6566
"<command>lxc.aa_profile = lxc-CN-profile</command> specifies a custom "
6567
"Apparmor profile in which to start the container. See <xref linkend=\"lxc-"
6568
"apparmor\"/> for more information."
6571
#: serverguide/C/virtualization.xml:3310(para)
6573
"<command>lxc.console=/path/to/consolefile</command> will cause console "
6574
"messages to be written to the specified file."
6577
#: serverguide/C/virtualization.xml:3315(para)
6579
"<command>lxc.arch</command> specifies the architecture for the container, "
6580
"for instance x86, or x86_64."
6583
#: serverguide/C/virtualization.xml:3320(para)
6585
"<command>lxc.tty=5</command> specifies that 5 consoles (in addition to "
6586
"<filename>/dev/console</filename>) should be created. That is, consoles will "
6587
"be available on <filename>/dev/tty1</filename> through "
6588
"<filename>/dev/tty5</filename>. The ubuntu templates set this value to 4."
6591
#: serverguide/C/virtualization.xml:3329(para)
6593
"<command>lxc.pts=1024</command> specifies that the container should have a "
6594
"private (Unix98) devpts filesystem mount. If this is not specified, then the "
6595
"container will share <filename>/dev/pts</filename> with the host, which is "
6596
"rarely desired. The number 1024 means that 1024 ptys should be allowed in "
6597
"the container, however this number is currently ignored. Before starting the "
6598
"container init, LXC will do (essentially) a"
6601
#: serverguide/C/virtualization.xml:3338(command)
6602
msgid "sudo mount -t devpts -o newinstance devpts /dev/pts"
6605
#: serverguide/C/virtualization.xml:3343(para)
6607
"inside the container. It is important to realize that the container should "
6608
"not mount devpts filesystems of its own. It may safely do bind or move "
6609
"mounts of its mounted <filename>/dev/pts</filename>. But if it does"
6612
#: serverguide/C/virtualization.xml:3349(command)
6613
msgid "sudo mount -t devpts devpts /dev/pts"
6616
#: serverguide/C/virtualization.xml:3354(para)
6618
"it will remount the host's devpts instance. If it adds the newinstance mount "
6619
"option, then it will mount a new private (empty) instance. In neither case "
6620
"will it remount the instance which was set up by LXC. For this reason, and "
6621
"to prevent the container from using the host's ptys, the default Apparmor "
6622
"policy will not allow containers to mount devpts filesystems after the "
6623
"container's init has been started."
6626
#: serverguide/C/virtualization.xml:3364(para)
6628
"<command>lxc.devttydir</command> specifies a directory under "
6629
"<filename>/dev</filename> in which LXC will create its console devices. If "
6630
"this option is not specified, then the ptys will be bind-mounted over "
6631
"<filename>/dev/console</filename> and <filename>/dev/ttyN.</filename> "
6632
"However, rare package updates may try to blindly <emphasis>rm -f</emphasis> "
6633
"and then <emphasis>mknod</emphasis> those devices. They will fail (because "
6634
"the file has been bind-mounted), causing the package update to fail. When "
6635
"<command>lxc.devttydir</command> is set to LXC, for instance, then LXC will "
6636
"bind-mount the console ptys onto <filename>/dev/lxc/console</filename> and "
6637
"<filename>/dev/lxc/ttyN,</filename> and subsequently symbolically link them "
6638
"to <filename>/dev/console</filename> and <filename>/dev/ttyN.</filename> "
6639
"This allows the package updates to succeed, at the risk of making future "
6640
"gettys on those consoles fail until the next reboot. This problem will be "
6641
"ideally solved with device namespaces."
6644
#: serverguide/C/virtualization.xml:3384(para)
6646
"The <command>lxc.hook.</command> options specify programs to run at various "
6647
"points in a container's life cycle. See <xref linkend=\"lxc-hooks\"/> for "
6648
"more information on these hooks. To have multiple hooks called at any point, "
6649
"list them in multiple entries. The possible values, whose precise meanings "
6650
"are described in <xref linkend=\"lxc-hooks\"/>, are"
6653
#: serverguide/C/virtualization.xml:3393(command)
6654
msgid "lxc.hook.pre-start"
6657
#: serverguide/C/virtualization.xml:3397(command)
6658
msgid "lxc.hook.pre-mount"
6661
#: serverguide/C/virtualization.xml:3401(command)
6662
msgid "lxc.hook.mount"
6665
#: serverguide/C/virtualization.xml:3405(command)
6666
msgid "lxc.hook.start"
6669
#: serverguide/C/virtualization.xml:3409(command)
6670
msgid "lxc.hook.post-stop"
6673
#: serverguide/C/virtualization.xml:3415(para)
6675
"The <command>lxc.include</command> option specifies another configuration "
6676
"file to be loaded. This allows common configuration sections to be defined "
6677
"once and included by several containers, simplifying updates of the common "
6681
#: serverguide/C/virtualization.xml:3422(para)
6683
"The <command>lxc.seccomp</command> option (introduced with Ubuntu 12.10) "
6684
"specifies a file containing a <emphasis>seccomp</emphasis> policy to load. "
6685
"See <xref linkend=\"lxc-security\"/> for more information on seccomp in lxc."
6688
#: serverguide/C/virtualization.xml:3433(title)
6689
msgid "Updates in Ubuntu containers"
6692
#: serverguide/C/virtualization.xml:3435(para)
6694
"Because of some limitations which are placed on containers, package upgrades "
6695
"at times can fail. For instance, a package install or upgrade might fail if "
6696
"it is not allowed to create or open a block device. This often blocks all "
6697
"future upgrades until the issue is resolved. In some cases, you can work "
6698
"around this by chrooting into the container, to avoid the container "
6699
"restrictions, and completing the upgrade in the chroot."
6702
#: serverguide/C/virtualization.xml:3443(para)
6704
"Some of the specific things known to occasionally impede package upgrades "
6708
#: serverguide/C/virtualization.xml:3448(para)
6710
"The container modifications performed when creating containers with the --"
6714
#: serverguide/C/virtualization.xml:3453(para)
6716
"Actions performed by lxcguest. For instance, because "
6717
"<filename>/lib/init/fstab</filename> is bind-mounted from another file, "
6718
"mountall upgrades which insist on replacing that file can fail."
6721
#: serverguide/C/virtualization.xml:3460(para)
6723
"The over-mounting of console devices with ptys from the host can cause "
6724
"trouble with udev upgrades."
6727
#: serverguide/C/virtualization.xml:3465(para)
6729
"Apparmor policy and devices cgroup restrictions can prevent package upgrades "
6730
"from performing certain actions."
6733
#: serverguide/C/virtualization.xml:3470(para)
6735
"Capabilities dropped by use of <command>lxc.cap.drop</command> can likewise "
6736
"stop package upgrades from performing certain actions."
6739
#: serverguide/C/virtualization.xml:3478(title)
6743
#: serverguide/C/virtualization.xml:3480(para)
6745
"Libvirt is a powerful hypervisor management solution with which you can "
6746
"administer Qemu, Xen and LXC virtual machines, both locally and remote. The "
6747
"libvirt LXC driver is a separate implementation from what we normally call "
6748
"<emphasis>LXC</emphasis>. A few differences include:"
6751
#: serverguide/C/virtualization.xml:3488(para)
6752
msgid "Configuration is stored in xml format"
6755
#: serverguide/C/virtualization.xml:3492(para)
6756
msgid "There no tools to facilitate container creation"
6759
#: serverguide/C/virtualization.xml:3496(para)
6760
msgid "By default there is no console on <filename>/dev/console</filename>"
6763
#: serverguide/C/virtualization.xml:3501(para)
6764
msgid "There is no support (yet) for container reboot or full shutdown"
6767
#: serverguide/C/virtualization.xml:3519(title)
6768
msgid "Converting a LXC container to libvirt-lxc"
6771
#: serverguide/C/virtualization.xml:3521(para)
6773
"<xref linkend=\"lxc-creation\"/> showed how to create LXC containers. If "
6774
"you've created a valid LXC container in this way, you can manage it with "
6775
"libvirt. Fetch a sample xml file from"
6778
#: serverguide/C/virtualization.xml:3526(command) serverguide/C/virtualization.xml:3571(command)
6779
msgid "wget http://people.canonical.com/~serge/o1.xml"
6782
#: serverguide/C/virtualization.xml:3531(para)
6784
"Edit this file to replace the container name and root filesystem locations. "
6785
"Then you can define the container with:"
6788
#: serverguide/C/virtualization.xml:3535(command)
6789
msgid "virsh -c lxc:/// define o1.xml"
6792
#: serverguide/C/virtualization.xml:3542(title)
6793
msgid "Creating a container from cloud image"
6796
#: serverguide/C/virtualization.xml:3544(para)
6798
"If you prefer to create a pristine new container just for LXC, you can "
6799
"download an ubuntu cloud image, extract it, and point a libvirt LXC xml file "
6800
"to it. For instance, find the url for a root tarball for the latest daily "
6801
"Ubuntu 12.04 LTS cloud image using"
6804
#: serverguide/C/virtualization.xml:3550(command)
6806
"url1=`ubuntu-cloudimg-query precise daily $arch --format \"%{url}\\n\"` "
6807
"url=`echo $url1 | sed -e 's/.tar.gz/-root\\0/'` wget $url filename=`basename "
6811
#: serverguide/C/virtualization.xml:3558(para)
6812
msgid "Extract the downloaded tarball, for instance"
6815
#: serverguide/C/virtualization.xml:3561(command)
6816
msgid "mkdir $HOME/c1 cd $HOME/c1 sudo tar zxf $filename"
6819
#: serverguide/C/virtualization.xml:3568(para)
6820
msgid "Download the xml template"
6823
#: serverguide/C/virtualization.xml:3576(para)
6825
"In the xml template, replace the name o1 with c1 and the source directory "
6826
"<filename>/var/lib/lxc/o1/rootfs</filename> with "
6827
"<filename>$HOME/c1</filename>. Then define the container using"
6830
#: serverguide/C/virtualization.xml:3581(command)
6831
msgid "virsh define o1.xml"
6834
#: serverguide/C/virtualization.xml:3588(title)
6835
msgid "Interacting with libvirt containers"
6838
#: serverguide/C/virtualization.xml:3590(para)
6839
msgid "As we've seen, you can create a libvirt-lxc container using"
6842
#: serverguide/C/virtualization.xml:3594(command)
6843
msgid "virsh -c lxc:/// define container.xml"
6846
#: serverguide/C/virtualization.xml:3599(para)
6847
msgid "To start a container called <emphasis>container</emphasis>, use"
6850
#: serverguide/C/virtualization.xml:3603(command)
6851
msgid "virsh -c lxc:/// start container"
6854
#: serverguide/C/virtualization.xml:3608(para)
6855
msgid "To stop a running container, use"
6858
#: serverguide/C/virtualization.xml:3611(command)
6859
msgid "virsh -c lxc:/// destroy container"
6862
#: serverguide/C/virtualization.xml:3616(para)
6864
"Note that whereas the <command>lxc-destroy</command> command deletes the "
6865
"container, the <command>virsh destroy</command> command stops a running "
6866
"container. To delete the container definition, use"
6869
#: serverguide/C/virtualization.xml:3622(command)
6870
msgid "virsh -c lxc:/// undefine container"
6873
#: serverguide/C/virtualization.xml:3627(para)
6874
msgid "To get a console to a running container, use"
6877
#: serverguide/C/virtualization.xml:3630(command)
6878
msgid "virsh -c lxc:/// console container"
6881
#: serverguide/C/virtualization.xml:3635(para)
6882
msgid "Exit the console by simultaneously pressing control and ]."
6885
#: serverguide/C/virtualization.xml:3641(title)
6886
msgid "The lxcguest package"
6889
#: serverguide/C/virtualization.xml:3643(para)
6891
"In the 11.04 (Natty) and 11.10 (Oneiric) releases of Ubuntu, a package was "
6892
"introduced called <emphasis role=\"italic\">lxcguest</emphasis>. An "
6893
"unmodified root image could not be safely booted inside a container, but an "
6894
"image with the lxcguest package installed could be booted as a container, on "
6895
"bare hardware, or in a Xen, kvm, or VMware virtual machine."
6898
#: serverguide/C/virtualization.xml:3650(para)
6900
"As of the 12.04 LTS release, the work previously done by the lxcguest "
6901
"package was pushed into the core packages, and the lxcguest package was "
6902
"removed. As a result, an unmodified 12.04 LTS image can be booted as a "
6903
"container, on bare hardware, or in a Xen, kvm, or VMware virtual machine. To "
6904
"use an older release, the lxcguest package should still be used."
6907
#: serverguide/C/virtualization.xml:3659(title)
6911
#: serverguide/C/virtualization.xml:3661(para)
6913
"As of 12.10 (Quantal) a <application>python3-lxc</application> package is "
6914
"available which provides a python module, called <command>lxc</command>, for "
6915
"managing <application>lxc</application> containers. An example python "
6916
"session to create and start an Ubuntu container called "
6917
"<filename>C1</filename>, then wait until it has been shut down, would look "
6921
#: serverguide/C/virtualization.xml:3668(programlisting)
5223
#: serverguide/C/virtualization.xml:2211(title) serverguide/C/mail.xml:390(title) serverguide/C/mail.xml:1702(title) serverguide/C/dns.xml:375(title)
5224
msgid "Troubleshooting"
5227
#: serverguide/C/virtualization.xml:2213(title) serverguide/C/network-auth.xml:765(title) serverguide/C/dns.xml:517(title)
5231
#: serverguide/C/virtualization.xml:2214(para)
5233
"If something goes wrong when starting a container, the first step should be "
5234
"to get full logging from LXC: <screen>\n"
5236
"sudo lxc-start -n C1 -l trace -o debug.out\n"
5238
"</screen> This will cause lxc to log at the most verbose level, "
5239
"<filename>trace</filename>, and to output log information to a file called "
5240
"'debug.out'. If the file <filename>debug.out</filename> already exists, the "
5241
"new log information will be appended."
5244
#: serverguide/C/virtualization.xml:2229(title)
5245
msgid "Monitoring container status"
5248
#: serverguide/C/virtualization.xml:2231(para)
5250
"Two commands are available to monitor container state changes. <command>lxc-"
5251
"monitor</command> monitors one or more containers for any state changes. It "
5252
"takes a container name as usual with the <emphasis>-n</emphasis> option, but "
5253
"in this case the container name can be a posix regular expression to allow "
5254
"monitoring desirable sets of containers. <command>lxc-monitor</command> "
5255
"continues running as it prints container changes. <command>lxc-"
5256
"wait</command> waits for a specific state change and then exits. For "
5260
#: serverguide/C/virtualization.xml:2241(command)
5261
msgid "sudo lxc-monitor -n cont[0-5]*"
5264
#: serverguide/C/virtualization.xml:2246(para)
5266
"would print all state changes to any containers matching the listed regular "
5267
"expression, whereas"
5270
#: serverguide/C/virtualization.xml:2250(command)
5271
msgid "sudo lxc-wait -n cont1 -s 'STOPPED|FROZEN'"
5274
#: serverguide/C/virtualization.xml:2255(para)
5276
"will wait until container cont1 enters state STOPPED or state FROZEN and "
5280
#: serverguide/C/virtualization.xml:2260(title)
5284
#: serverguide/C/virtualization.xml:2261(para)
5286
"As of Ubuntu 14.04, it is possible to attach to a container's namespaces. "
5287
"The simplest case is to simply do <screen>\n"
5289
"sudo lxc-attach -n C1\n"
5291
"</screen> which will start a shell attached to C1's namespaces, or, "
5292
"effectively inside the container. The attach functionality is very flexible, "
5293
"allowing attaching to a subset of the container's namespaces and security "
5294
"context. See the manual page for more information."
5297
#: serverguide/C/virtualization.xml:2277(title)
5298
msgid "Container init verbosity"
5301
#: serverguide/C/virtualization.xml:2278(para)
5303
"If LXC completes the container startup, but the container init fails to "
5304
"complete (for instance, no login prompt is shown), it can be useful to "
5305
"request additional verbosity from the init process. For an upstart "
5306
"container, this might be: <screen>\n"
5308
"sudo lxc-start -n C1 /sbin/init loglevel=debug\n"
5310
"</screen> You can also start an entirely different program in place of init, "
5311
"for instance <screen>\n"
5313
"sudo lxc-start -n C1 /bin/bash\n"
5314
"sudo lxc-start -n C1 /bin/sleep 100\n"
5315
"sudo lxc-start -n C1 /bin/cat /proc/1/status\n"
5320
#: serverguide/C/virtualization.xml:2302(title)
5324
#: serverguide/C/virtualization.xml:2304(para)
5326
"Most of the LXC functionality can now be accessed through an API exported by "
5327
"<filename>liblxc</filename> for which bindings are available in several "
5328
"languages, including Python, lua, ruby, and go."
5331
#: serverguide/C/virtualization.xml:2308(para)
5333
"Below is an example using the python bindings (which are available in the "
5334
"<application>python3-lxc</application> package) which creates and starts a "
5335
"container, then waits until it has been shut down:"
5338
#: serverguide/C/virtualization.xml:2314(programlisting)
30396
28805
"Jabber Server Ubuntu Wiki</ulink> page has more information."
28808
#: serverguide/C/cgroups.xml:13(para)
28810
"Control groups (cgroups) are a kernel mechanism for grouping, tracking, and "
28811
"limiting the resource usage of tasks. The kernel-provided administration "
28812
"interface is through a virtual filesystem. Higher level cgroup "
28813
"administration tools have been developed, including libcgroup and lmctfy. "
28814
"Additionally, there is guidance at freedesktop.org for how applications can "
28815
"best cooperate using the cgroup filesystem interface (see Resources)."
28818
#: serverguide/C/cgroups.xml:23(para)
28820
"As of Ubuntu 14.04, the cgroup manager (cgmanager) is available as another "
28821
"cgroup administion interface. It's goal is to respond to dbus requests from "
28822
"any user, allowing him to administer only those cgroups which have been "
28823
"delegated to him."
28826
#: serverguide/C/cgroups.xml:30(para)
28828
"<xref linkend=\"cgroups-overview\"/> will describe cgroups in more detail. "
28829
"<xref linkend=\"cgroups-fs\"/> will describe the long-standing cgroups "
28830
"filesystem interface. <xref linkend=\"cgroups-manager\"/> will describe the "
28834
#: serverguide/C/cgroups.xml:40(para)
28836
"Cgroups are the generalized feature for grouping tasks. The actual resource "
28837
"tracking and limits are implemented by subsystems. A hierarchy is a set of "
28838
"subsystems mounted together. For instance, if the memory and devices "
28839
"subsystems are mounted together under /sys/fs/cgroups/set1, then any task "
28840
"which is in \"/child1\" will be subject to the corresponding limits of both "
28844
#: serverguide/C/cgroups.xml:49(para)
28846
"Each set of mounted subsystems consittutes a 'hierarchy'. With exceptions, "
28847
"cgroups which are children of \"/child1\" will be subject to all limits "
28848
"placed on \"/child1\", and their resource usage will be accounted to "
28852
#: serverguide/C/cgroups.xml:56(para)
28853
msgid "The existing subsystems include:"
28856
#: serverguide/C/cgroups.xml:61(para)
28858
"<emphasis>cpusets</emphasis>: fascilitate assigning a set of CPUS and memory "
28859
"nodes to cgroups. Tasks in a cpuset cgroup may only be scheduled on CPUS "
28860
"assigned to that cpuset."
28863
#: serverguide/C/cgroups.xml:65(para)
28864
msgid "<emphasis> blkio </emphasis>: limits per-cgroup block io."
28867
#: serverguide/C/cgroups.xml:66(para)
28869
"<emphasis> cpuacct </emphasis>: provides per-cgroup cpu usage accounting."
28872
#: serverguide/C/cgroups.xml:67(para)
28874
"<emphasis> devices </emphasis>: controls the ability of tasks to create or "
28875
"use devices nodes using either a blacklist or whitelist."
28878
#: serverguide/C/cgroups.xml:69(para)
28880
"<emphasis> freezer </emphasis>: provides a way to 'freeze' and 'thaw' whole "
28881
"cgroups. Tasks in the cgroup will not be scheduled while they are frozen."
28884
#: serverguide/C/cgroups.xml:71(para)
28886
"<emphasis> hugetlb </emphasis>: fascilitates limiting hugetlb usage per "
28890
#: serverguide/C/cgroups.xml:72(para)
28892
"<emphasis> memory </emphasis>: allows memory, kernel memory, and swap usage "
28893
"to be tracked and limited."
28896
#: serverguide/C/cgroups.xml:74(para)
28898
"<emphasis> net_cls </emphasis>: provides an interface for tagging packets "
28899
"based on the sender cgroup. These tags can then be used by tc (traffic "
28900
"controller) to assign priorities."
28903
#: serverguide/C/cgroups.xml:77(para)
28905
"<emphasis> net_prio </emphasis>: allows setting network traffic priority on "
28906
"a per-cgroup basis."
28909
#: serverguide/C/cgroups.xml:79(para)
28911
"<emphasis> cpu </emphasis>: enables setting of scheduling preferences on per-"
28915
#: serverguide/C/cgroups.xml:80(para)
28917
"<emphasis> perf_event </emphasis>: enables per-cpu mode to monitor only "
28918
"threads in certain cgroups."
28921
#: serverguide/C/cgroups.xml:84(para)
28923
"In addition, named cgroups can be created with no bound subsystems for the "
28924
"sake of process tracking. As an example, systemd does this to track services "
28925
"and user sessions."
28928
#: serverguide/C/cgroups.xml:93(title)
28932
#: serverguide/C/cgroups.xml:95(para)
28934
"A hierarchy is created by mounting an instance of the cgroup filesystem with "
28935
"each of the desired subsystems listed as a mount option. For instance,"
28938
#: serverguide/C/cgroups.xml:100(command)
28939
msgid "mount -t cgroup -o devices,memory,freezer cgroup /cgroup1"
28942
#: serverguide/C/cgroups.xml:104(para)
28944
"would instantiate a hierarchy with the devices and memory cgroups comounted. "
28945
"A child cgroup \"child1\" can be created using 'mkdir'"
28948
#: serverguide/C/cgroups.xml:109(command)
28949
msgid "mkdir /cgroup1/child1"
28952
#: serverguide/C/cgroups.xml:113(para)
28954
"and tasks can be moved into the new child cgroup by writing their process "
28955
"ids into the 'tasks' or 'cgroup.procs' file:"
28958
#: serverguide/C/cgroups.xml:118(command)
28959
msgid "sleep 100 echo $! > /cgroup1/child1/cgroup.procs"
28962
#: serverguide/C/cgroups.xml:123(para)
28964
"Other administration is done through files in the cgroup directories. For "
28965
"instance, to freeze all tasks in child1,"
28968
#: serverguide/C/cgroups.xml:128(command)
28969
msgid "echo FROZEN > /cgroup1/child1/freezer.state"
28972
#: serverguide/C/cgroups.xml:132(para)
28974
"A great deal of information about cgroups and its subsystems can be found "
28975
"under the cgroups documentation directory in the kernel source tree (see "
28979
#: serverguide/C/cgroups.xml:141(title)
28983
#: serverguide/C/cgroups.xml:143(para)
28985
"Cgroup files and directories can be owned by non-root users, enabling "
28986
"delegation of cgroup administration. In general, the kernel enforces the "
28987
"hierarchical constraints on limits, so that for instance if devices cgroup "
28988
"<filename>/child1</filename> cannot access a disk drive, then "
28989
"<filename>/child1/child2</filename> cannot give itself those rights."
28992
#: serverguide/C/cgroups.xml:151(para)
28994
"As of Ubuntu 14.04, users are automatically placed in a set of cgroups which "
28995
"they own, safely allowing them to contrain their own jobs using child "
28996
"cgroups. This feature is relied upon, for instance, for unprivileged "
28997
"container creation in lxc."
29000
#: serverguide/C/cgroups.xml:161(title)
29004
#: serverguide/C/cgroups.xml:163(para)
29006
"The cgroup manager (cgmanager) provides a D-Bus service allowing programs "
29007
"and users to administer cgroups without needing direct knowledge of or "
29008
"access to the cgroup filesystem. For requests from tasks in the same "
29009
"namespaces as the manager, the manager can directly perform the needed "
29010
"security checks to ensure that requests are legitimate. For other requests - "
29011
"such as those from a task in a container - enhanced D-Bus requests must be "
29012
"made, where process-, user- and group-ids are passed as SCM_CREDENTIALS, so "
29013
"that the kernel maps the identifiers to their global host values."
29016
#: serverguide/C/cgroups.xml:175(para)
29018
"To fascilitate the use of simple D-Bus calls from all users, a 'cgroup "
29019
"manager proxy' (cgproxy) is automatically started when in a container. The "
29020
"proxy accepts standard D-Bus requests from tasks in the same namespaces as "
29021
"itself, and converts them to SCM-enhanced D-Bus requests which it passes on "
29022
"to the cgmanager."
29025
#: serverguide/C/cgroups.xml:183(para)
29027
"A simple example of creating a new cgroup in which to run a cpu-intensive "
29028
"compile would look like:"
29031
#: serverguide/C/cgroups.xml:188(command)
29033
"dbus-send --print-reply --address=unix:path=/sys/fs/cgroup/cgmanager/sock \\ "
29034
"--type=method_call /org/linuxcontainers/cgmanager \\ "
29035
"org.linuxcontainers.cgmanager0_0.Create string:'cpuset' string:\"build1\" "
29036
"dbus-send --print-reply --address=unix:path=/sys/fs/cgroup/cgmanager/sock \\ "
29037
"--type=method_call /org/linuxcontainers/cgmanager \\ "
29038
"org.linuxcontainers.cgmanager0_0.MovePid string:'cpuset' \\ "
29039
"string:\"build1\" int32:$$ dbus-send --print-reply --"
29040
"address=unix:path=/sys/fs/cgroup/cgmanager/sock \\ --type=method_call "
29041
"/org/linuxcontainers/cgmanager \\ org.linuxcontainers.cgmanager0_0.SetValue "
29042
"string:'cpuset' \\ string:\"build1\" string:\"cpuset.cpus\" string:\"1\" make"
29045
#: serverguide/C/cgroups.xml:203(para)
29047
"The above can also be done much more simply by using lmctfy or cgroup-bin, "
29048
"once they are converted to use the cgmanager."
29051
#: serverguide/C/cgroups.xml:217(ulink)
29052
msgid "cgconfig.conf"
29055
#: serverguide/C/cgroups.xml:218(ulink)
29059
#: serverguide/C/cgroups.xml:219(ulink)
29063
#: serverguide/C/cgroups.xml:224(para)
29065
"The upstream cgmanager project is hosted at <ulink "
29066
"url=\"http://cgmanager.linuxcontainers.org\">linuxcontainers.org</ulink>."
29069
#: serverguide/C/cgroups.xml:229(para)
29071
"The upstream kernel documentation page on cgroups can be seen <ulink "
29072
"url=\"https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/Do"
29073
"cumentation/cgroups\">here </ulink>."
29076
#: serverguide/C/cgroups.xml:235(para)
29078
"The freedesktop.org control group usage guidelines can be seen <ulink "
29079
"url=\"http://www.freedesktop.org/wiki/Software/systemd/PaxControlGroups/\">he"
30399
29083
#: serverguide/C/backups.xml:12(para)
30401
29085
"There are many ways to backup an Ubuntu installation. The most important "